feat(bootstrap): Windows recovery + reinstall toolkit for GURU-5070

Add .claude/bootstrap/ (windows-bootstrap.ps1, restore-secrets.ps1,
backup-to-bundle.ps1, RESTORE.md) plus machines/guru-5070.md. Idempotent
11-phase rebuild after a clean Windows reset: winget core tools + .NET/WiX,
protoc, Poppler, Tailscale; restore SOPS age key/SSH/tool-auth/identity from
the E:/F: recovery bundle; clone repos+submodules; set OLLAMA_MODELS/HOST/PROTOC;
detect existing D:\OllamaModels; register scheduled tasks. Includes session log.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/machines/guru-5070.md

@@ -0,0 +1,67 @@
+# Machine: GURU-5070 (Windows)
+
+**Hostname:** GURU-5070
+**User:** Mike Swanson (mike) — admin
+**Platform:** Windows 11 Pro 10.0.26200
+**Last Updated:** 2026-06-06
+
+> Same physical hardware as `acg-guru-5070.md` (Lenovo Legion Pro 7 16IAX10H) —
+> that profile documents the prior CachyOS Linux install. This box now runs Windows.
+
+---
+
+## Hardware
+
+| Spec | Value |
+|------|-------|
+| Model | Lenovo Legion Pro 7 16IAX10H (DMI 83F5) |
+| CPU | Intel Core Ultra 9 275HX (24 cores) |
+| Memory | 32 GB DDR5 |
+| GPU | NVIDIA GeForce RTX 5070 Ti Laptop (12 GB) |
+| Disks | C: 952 GB NVMe (OS), D: 953 GB NVMe (dev — `D:\claudetools`, `D:\vault`, `D:\work`) |
+
+## Paths
+
+| What | Where |
+|------|-------|
+| ClaudeTools | `D:\claudetools` |
+| Vault | `D:\vault` |
+| Other repos | `D:\work\gururmm` |
+| SOPS age key | `%APPDATA%\sops\age\keys.txt` and `~\.config\sops\age\keys.txt` |
+| Claude CLI | `~\.local\bin\claude.exe` (native installer) |
+| Grok CLI | `~\.grok\bin\grok.exe` |
+| Gemini CLI | npm global (`@google/gemini-cli`) |
+
+## Toolchain (as of 2026-06-06)
+
+node 24.x · npm 11.x · py/Python 3.14 · git 2.53 · cargo/rustc 1.96 ·
+ollama 0.30.6 · jq 1.8 · sops 3.7→3.12 · age 1.3 · op 2.33 · VS Code 1.113 ·
+claude 2.1.x · gemini 0.45 · grok 0.2.x. **gh was missing** — bootstrap installs it.
+
+Ollama models: `nomic-embed-text`, `qwen3:8b`, `qwen3:14b`, `codestral:22b`, `qwen3.6:latest`.
+
+## Scheduled tasks (ClaudeTools)
+
+- `GrepAI Watcher - claudetools` → `D:\claudetools\grepai.exe watch --background` (logon)
+- `ClaudeTools - Orphaned Session Detector` → `py detect_orphaned_sessions.py` (logon + daily)
+- `ClaudeTools - KSTEEN SmartBadge Daily` → git-bash `check-ksteen-smartbadge.sh` (daily)
+
+## Capabilities
+
+- [x] Git / Gitea, SSH to infra
+- [x] GrepAI watcher
+- [x] Ollama local AI (RTX 5070 Ti — light/inference OK)
+- [x] MCP: ticktick, grepai
+- [x] claude / gemini / grok CLIs (fleet host for all three)
+
+## Recovery
+
+Full rebuild after a reset: `.claude\bootstrap\RESTORE.md`.
+Recovery bundle on **E:** and **F:** (`\claudetools-recovery\`). Refresh it with
+`.claude\bootstrap\backup-to-bundle.ps1`.
+
+## Known issues
+
+- Old `D:\work\gururmm` remote URL embedded the shared Gitea password in plaintext —
+  reset to a clean URL + Windows Credential Manager on rebuild.
+- (Hardware) RTX 5070 Ti GSP firmware bug under sustained GPU compute — see `acg-guru-5070.md`.