Create and restore-test a gold installation image

[ReidSurmeier]

The repository documents source recovery, but no current gold SD-card image and restore drill are verified.

Human and hardware work:

• capture an image only after a known-good live validation
• record device model, capacity, partition layout, operating-system release, and tested repository commit
• store at least two checksummed copies outside the live card
• restore onto a separate card and boot it in controlled hardware
• rerun service, browser, display mapping, GPIO, relay, UPS, and health-timer checks

Acceptance criteria:

• image hashes and custody locations are recorded without publishing private paths or credentials
• an independent restored card reaches the expected safe operating state
• RECOVERY.md and PROJECT.md identify the tested date and limitations.