feat(recovery): connect bootstrap to identity backup verification

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2

tools/cmd/railiance-identity-recovery

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Bootstrap handoff to the identity owner's isolated archive verifier.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+if [[ $# == 0 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  cat <<'EOF'
+Usage: bin/railiance identity-recovery --transfer-receipt PATH --receipt NEW_PATH
+
+Run through net-kingdom/sso-mfa/bootstrap/sops-custody-unlock.sh --prompt
+with the independently held railiance-backup age key. Requires an independently
+retrieved ciphertext and its safe transfer receipt, age, Docker and the pinned
+PostgreSQL image. Default owner checkout: sibling net-kingdom; set
+NETKINGDOM_RECOVERY_ROOT to an explicitly reviewed alternative checkout.
+
+This decrypts only into disposable local storage and verifies the full manifest,
+SQLite/key pairs and native PostgreSQL restore. It does not restore production,
+contact SSO or prove full identity authentication/audit continuity.
+See docs/identity-recovery.md for the bootstrap ordering and custody handoff.
+EOF
+  exit 0
+fi
+OWNER="${NETKINGDOM_RECOVERY_ROOT:-${ROOT}/../net-kingdom}"
+CHECKER="${OWNER}/tools/bootstrap-recovery/verify-identity.py"
+if [[ ! -f "$CHECKER" || ! -f "${OWNER}/tools/bootstrap-recovery/identity-backup-profile.json" ]]; then
+  echo 'Missing reviewed NetKingdom recovery checkout; see docs/identity-recovery.md.' >&2
+  exit 1
+fi
+exec python3 "$CHECKER" "$@"