Add kill switch and recover.sh for emergency recovery

If the patch ever prevents middlewared from starting, users now have a
clear escape hatch that requires no knowledge of Python internals:

  bash /data/truecloud-patch/recover.sh

Or at a bare shell prompt:

  touch /data/truecloud-patch/disabled
  systemctl restart middlewared

sitecustomize.py checks for /data/truecloud-patch/disabled at Python
startup and skips the import hook entirely when the file exists.
apply.sh does the same so the PREINIT script also does nothing on reboot.

recover.sh is copied to /data/truecloud-patch/ by install.sh so it is
available even without the original repo directory.

README gains an "Emergency recovery" section above Troubleshooting.

patch/apply.sh

@@ -29,6 +29,15 @@ fi
 exec >> "$LOG" 2>&1
 echo "=== $(date -Iseconds) ==="
 
+# Kill switch: if this file exists, skip all patching and exit cleanly.
+# Recovery: touch /data/truecloud-patch/disabled (then reboot or restart middlewared).
+if [ -f "$PATCH_DIR/disabled" ]; then
+    echo "Kill switch active ($PATCH_DIR/disabled exists) — patch not applied."
+    echo "To re-enable: rm $PATCH_DIR/disabled"
+    echo "=== done ==="
+    exit 0
+fi
+
 # ── Helpers ───────────────────────────────────────────────────────────────────
 
 warn() { echo "WARNING: $*"; }

patch/sitecustomize.py

@@ -183,6 +183,9 @@ _PATCHES = {
 
 def _install():
     import importlib.util
+    import os
+    if os.path.exists("/data/truecloud-patch/disabled"):
+        return  # kill switch: touch /data/truecloud-patch/disabled to bypass this hook
     if importlib.util.find_spec("middlewared") is None:
         return  # not a middlewared Python process; nothing to do
     sys.meta_path.append(_Finder())