Add post-stabilization next-step runbook for vpnruntime

docs/operations/VPNRUNTIME_POST_STABILIZATION_NEXT_STEPS_2026-05-12.md

@@ -0,0 +1,56 @@
+# VPN Runtime Post-Stabilization Next Steps
+
+Date: 2026-05-12
+Branch: `main`
+
+## Goal
+
+Provide a minimal operational sequence after pulling the stabilization chain.
+
+## 1. Sync
+
+```bash
+git checkout main
+git pull --ff-only origin main
+```
+
+## 2. Guard Validation
+
+From repository root:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
+```
+
+Expected:
+
+- all guard steps pass
+- no flaky failures in targeted parallel flow-window test
+
+## 3. CI Gate Expectations
+
+`node-agent` workflow path should execute:
+
+- `go test ./...`
+- `go test ./internal/vpnruntime -count=20`
+- targeted anti-flake test (`-count=50`, timeout `60s`)
+- `go test -race ./internal/vpnruntime`
+- one-shot guard script
+
+## 4. Development Start Condition
+
+Begin new feature work only when:
+
+- local one-shot guard is PASS
+- remote CI pipeline is green on `main`
+
+## 5. If Flake Reappears
+
+Immediate triage sequence:
+
+1. Re-run targeted test locally with higher repeat count (`-count=100`).
+2. Re-run one-shot guard script.
+3. Capture failing output and update:
+   - `docs/operations/VPNRUNTIME_CI_STABILIZATION_CHANGELOG_2026-05-12.md`
+   - `docs/operations/VPNRUNTIME_STAGE_EXECUTION_2026-05-12.md`
+