feat(runbooks): add Neo4j graph traversal and AlloyDB vector similarity AI runbooks

[dandye]

Summary

This PR adds two essential AI Security Runbooks for SOC agent grounding:

1. Neo4j Graph Relationship Traversal & Blast Radius Analysis (rules_bank/run_books/neo4j_graph_traversal_and_blast_radius.md):

   • Documents Cypher relationship patterns for host connectivity (LOGGED_ON_TO, CONNECTED_TO) and Active Directory privilege escalation (MEMBER_OF, HAS_ADMIN, CAN_REACH).
   • Outlines step-by-step investigation procedures, SIEM log fallback workflows, and structured blast radius isolation plans.

2. AlloyDB Multi-Modal Vector Similarity Investigation Grounding (rules_bank/run_books/alloydb_vector_similarity_investigation_grounding.md):

   • Details dual-mode retrieval strategies (768-dim text-embedding-004 vector similarity vs exact metadata SQL lookups).
   • Prescribes scoring profile weightings (threat-hunt, incident-response, detection-engineering) for citing historical detection reports and past incident verdicts.

[dandye]

Review (blocking findings before merge):

1. Both files violate runbook_guidelines.md mandatory structure: bare Workflow Steps with no Mermaid diagram, no Completion Criteria, no Rubric (32/32 existing runbooks have all three).
2. Frontmatter is non-conforming: type: Playbook + resource/timestamp/provenance vs the OKF v0.2 schema (type: runbook, category, status, tags, generated).
3. References tools that exist nowhere in the repo (query_knowledge_graph, query_alloydb_detection_reports, save_report_artifact, execute_manual_action) and MCP servers (neo4j-mcp, alloydb-mcp) absent from agent_tool_mapping.md — add them to the tool-mapping docs or use agent-agnostic phrasing per runbook_guidelines.md.
4. Correctness: the Cypher blast-radius patterns are undirected (-[r:MEMBER_OF|HAS_ADMIN|CAN_REACH*1..3]-), which walks edges backwards and will return every co-member of a user's groups as a privilege-escalation path — feeding false positives straight into the Tier 1 Immediate Isolation list. Should be directed with DISTINCT/LIMIT.
5. Declared ${MAX_HOPS}/${TOP_K}/etc inputs are never threaded into the queries.

Content direction is good (embedding model/dims check out); fixes are mechanical. Happy to merge after alignment.