🔧 fix(ops): make migration key recipes container-safe

Update migration/master-key just recipes to run via uv across repo and container contexts without direct python invocation, and codify approval requirements for justfile and python command patterns in AI-first docs.

Author: attid

AGENTS.md

@@ -44,6 +44,9 @@ an index. Detailed rules live in `docs/`.
 4. Read `bot/tests/README.md` before adding/changing tests.
 5. Router tests must use `mock_telegram`.
 6. Do not weaken tests, linters, or CI checks to make a change pass.
+7. Do not add or modify `justfile` commands without explicit user approval.
+8. Do not introduce `python ...` or `uv run python ...` command patterns in
+   recipes/docs/workflows without explicit user approval.
 
 ## Task Intake Protocol
 1. First state which files/directories need changes.

AI_FIRST.md

@@ -252,6 +252,8 @@ domain ← application ← infrastructure
 * Менять CI-пайплайн или конфигурацию деплоя.
 * Удалять или понижать существующее тестовое покрытие.
 * Принимать архитектурные решения, не описанные в `docs/golden-principles.md`, без создания нового ADR.
+* Добавлять/менять команды в `justfile` без явного согласования с человеком.
+* Продвигать паттерн команд `python ...` или `uv run python ...` в рецептах/доках/workflow без явного согласования с человеком.
 
 ---
 

justfile

@@ -74,7 +74,10 @@ bench-kdf:
     uv run --with argon2-cffi python bot/scripts/argon2_benchmark.py
 
 migrate-wallet-crypto-v2 args="--dry-run":
-    cd bot && uv run --package mmwb-bot python scripts/migrate_wallet_crypto_v2.py {{args}}
+    if [ -f bot/scripts/migrate_wallet_crypto_v2.py ]; then cd bot && uv run --package mmwb-bot scripts/migrate_wallet_crypto_v2.py {{args}}; elif [ -f scripts/migrate_wallet_crypto_v2.py ] && [ -f ../pyproject.toml ]; then cd .. && cd bot && uv run --package mmwb-bot scripts/migrate_wallet_crypto_v2.py {{args}}; else uv run --no-project scripts/migrate_wallet_crypto_v2.py {{args}}; fi
+
+manage-master-key args="--help":
+    if [ -f bot/scripts/manage_keys.py ]; then cd bot && uv run --package mmwb-bot scripts/manage_keys.py {{args}}; elif [ -f scripts/manage_keys.py ] && [ -f ../pyproject.toml ]; then cd .. && cd bot && uv run --package mmwb-bot scripts/manage_keys.py {{args}}; else uv run --no-project scripts/manage_keys.py {{args}}; fi
 
 start-task task_id title="":
     uv run python .linters/create_exec_plan.py {{task_id}} --title "{{title}}"