v1.0.0 - guarded recovery kit

Superseded by v1.0.1.

Do not use the v1.0.0 Apply/Restore scripts. v1.0.1 tightens manifest trust, canonical live-runtime paths, reparse-point checks, process enumeration, signed-Node validation, and pre-replacement rechecks. The read-only inspection and background analysis remain available in the current main branch.