Add kill switch and recover.sh for emergency recovery

If the patch ever prevents middlewared from starting, users now have a
clear escape hatch that requires no knowledge of Python internals:

  bash /data/truecloud-patch/recover.sh

Or at a bare shell prompt:

  touch /data/truecloud-patch/disabled
  systemctl restart middlewared

sitecustomize.py checks for /data/truecloud-patch/disabled at Python
startup and skips the import hook entirely when the file exists.
apply.sh does the same so the PREINIT script also does nothing on reboot.

recover.sh is copied to /data/truecloud-patch/ by install.sh so it is
available even without the original repo directory.

README gains an "Emergency recovery" section above Troubleshooting.

README.md

@@ -167,6 +167,36 @@ restart.
 
 ---
 
+## Emergency recovery
+
+If middlewared stops starting after installing this patch, run this from the
+TrueNAS shell (local console, SSH, or the debug shell in the UI):
+
+```bash
+bash /data/truecloud-patch/recover.sh
+```
+
+That creates a kill-switch file (`/data/truecloud-patch/disabled`) that
+`sitecustomize.py` checks at startup. With the switch set, the import hook is
+skipped entirely and middlewared starts clean. Your system returns to
+Storj-only TrueCloud Backup — nothing else is affected.
+
+If you cannot run a script and only have a bare shell prompt:
+
+```bash
+touch /data/truecloud-patch/disabled
+systemctl restart middlewared
+```
+
+To re-enable the patch after investigating:
+
+```bash
+rm /data/truecloud-patch/disabled
+bash /data/truecloud-patch/apply.sh
+```
+
+---
+
 ## Troubleshooting
 
 **Apply log** (check after each reboot or install):