docs(spike): add runbook + definition of done

Consolidate the scattered run instructions and pass/fail criteria into one place:
- design spec gains 'Running the spike' (venv bootstrap + flags + DB prereqs) and
  'Definition of done' (Req 0-4 are the bar; coverage does not gate done-ness;
  the only follow-up at ~100% CLIP coverage is one no-flag re-run to snapshot the
  final coverage into the contract doc) sections, and the status line now reads
  'passed 2026-06-27'.
- script docstring Usage now includes the missing 'python3 -m venv .venv' bootstrap
  a fresh checkout needs, and points to the spec's definition of done.

scripts/pgvector_spike.py

@@ -15,12 +15,17 @@ This is read-only and idempotent. The DB session is opened read-only at the
 session layer (not merely by which statements we issue), so even Immich's
 write-capable postgres user cannot mutate the source-of-truth DB while we probe.
 
-Usage:
-    IMMICH_DB_URL=postgresql://user:pass@host:5432/immich \\
-        python scripts/pgvector_spike.py
+Usage (from the repo root; a fresh checkout / new worktree has no .venv):
+    python3 -m venv .venv
+    .venv/bin/python -m pip install -r scripts/requirements-spike.txt
+    .venv/bin/python scripts/pgvector_spike.py        # read-only, idempotent, safe to re-run
 
-    # or rely on a .env (searched upward from CWD) that defines IMMICH_DB_URL
-    python scripts/pgvector_spike.py [--sqlite PATH] [--findings PATH] [--no-write]
+IMMICH_DB_URL is read from the environment, else from the nearest .env searched upward from the
+working directory (postgresql://USER:PASS@HOST:PORT/DBNAME). Or pass it inline:
+    IMMICH_DB_URL=postgresql://user:pass@host:5432/immich .venv/bin/python scripts/pgvector_spike.py
+
+Flags: --sqlite PATH (optional SQLite cross-check), --findings PATH, --no-write (report only).
+See docs/superpowers/specs/2026-06-27-pgvector-embedding-spike-design.md for the definition of done.
 """
 from __future__ import annotations