feat(bootstrap): restore rescued GuruRMM/GuruConnect WIP on rebuild

Add restore-at-risk-work.ps1 and wire it into bootstrap Phase 6. Recreates
local-only WIP rescued to the recovery bundle's at-risk-work/: re-applies the
three guru-rmm stash patches back AS stashes (LIFO order preserved) and drops
the guru-connect tmp-spec018.diff back as its untracked working file. Patches
that won't apply cleanly are reported for manual git apply --3way. Updates
RESTORE.md and the session log with the rescue details.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

session-logs/2026-06-06-windows-bootstrap-recovery.md

@@ -65,6 +65,22 @@ Full read-only sweep of the environment:
 - Bootstrap toolkit committed to repo (3rd copy, fleet-reusable).
 - Part 2 (the actual reset + rebuild) pending — driven by `F:\claudetools-recovery\bootstrap\windows-bootstrap.ps1`.
 
+## At-risk WIP rescued (addendum)
+
+Checked the GuruRMM/GuruConnect repos for local-only work a reset would destroy.
+All committed code was already pushed (every submodule HEAD is on origin), but found
+uncommitted WIP and preserved it to `at-risk-work\` on both E: and F:
+
+- **guru-rmm** (3 stashes, exported as patches): `stash@{0}` +119 lines `docs/FEATURE_ROADMAP.md`;
+  `stash@{1}` `CONTEXT.md`; `stash@{2}` `agent/Dockerfile` + `docs/unraid-ca-template.xml`.
+- **guru-connect**: untracked `tmp-spec018.diff` (54 KB; `agent/src/install.rs` + more).
+- `D:\work\gururmm`: only a local deletion of a legacy file still on remote — no loss.
+
+Original stashes left intact (not dropped). Added `restore-at-risk-work.ps1` and wired it
+into bootstrap Phase 6: on rebuild it re-applies the guru-rmm patches **back as stashes**
+(LIFO order preserved) and drops the guru-connect diff back as its untracked file. Patches
+that won't apply cleanly are reported and left for manual `git apply --3way`.
+
 ## Follow-ups
 - When ready to reset: run the bootstrap from the drive; verify vault decrypts via
   `vault.sh get-field projects/claudetools/database.sops.yaml credentials.password`.