Phase 1 MVP: drop-in step registry + session + Markdown report

Plugin skeleton, drop-in step registry, option-backed session, single-page
checklist UI, downloadable Markdown report. Steps live as one file each
under includes/steps/ — adding/removing one is a single file change.
Step IDs are stable strings so renaming files preserves session data.

Architecture (hc-5ix.3): WPH_Steps singleton globs includes/steps/*.php,
natsort-orders by filename, requires each file (which returns a WPH_Step
instance), then applies a 'wph_steps' filter so installs can drop steps.

Session (hc-5ix.4): option-backed (per decision — plugin is installed
per-engagement, so DB-resident history would be lost on uninstall).
Single in-progress session per site; finished sessions render a report
that the user downloads/copies.

Recovery bootstrap (hc-5ix.1): detects whether wp-site-recovery is
installed + active, surfaces state on the start panel and in every
active session. Manual install for now; private update channel deferred
to hc-5ix.27.

Smoke-tested on testsite: registry discovery (13 steps in correct order),
start → update_step → progress count → finish → 8KB Markdown report →
discard cycle.

includes/recovery-bootstrap.php

@@ -0,0 +1,58 @@
+<?php
+if (!defined('ABSPATH')) exit;
+
+/**
+ * Step-0 bootstrap: ensure wp-site-recovery is installed + active before the
+ * stepper runs (bead hc-5ix.1, references decision hc-5ix.26).
+ *
+ * Detection is by plugin folder slug, not by main-file path, because the slug
+ * is stable across releases. If we ever publish a private update channel for
+ * the recovery plugin, this is also where we'd offer "fetch latest".
+ */
+final class WPH_Recovery_Bootstrap {
+
+    public const RECOVERY_SLUG = 'site-recovery';
+    public const RECOVERY_MAIN = 'site-recovery/site-recovery.php';
+
+    public static function is_installed(): bool {
+        if (!function_exists('get_plugins')) {
+            require_once ABSPATH . 'wp-admin/includes/plugin.php';
+        }
+        return array_key_exists(self::RECOVERY_MAIN, get_plugins());
+    }
+
+    public static function is_active(): bool {
+        if (!function_exists('is_plugin_active')) {
+            require_once ABSPATH . 'wp-admin/includes/plugin.php';
+        }
+        return is_plugin_active(self::RECOVERY_MAIN);
+    }
+
+    public static function recovery_admin_url(): string {
+        return admin_url('tools.php?page=site-recovery');
+    }
+
+    /**
+     * Render a status panel that the admin page calls from the "Before you start"
+     * section. Phase-1: report state + link to manage. Phase-3 may add a
+     * one-click installer from a private URL.
+     */
+    public static function render_status(): void {
+        $installed = self::is_installed();
+        $active    = $installed && self::is_active();
+        ?>
+        <div class="wph-bootstrap-panel">
+            <h3>Recovery plugin status</h3>
+            <?php if ($active): ?>
+                <p class="wph-ok">✓ <strong>Site Recovery</strong> is installed and active.
+                <a href="<?php echo esc_url(self::recovery_admin_url()); ?>">Open recovery settings</a> to copy the URL + password into the client record.</p>
+            <?php elseif ($installed): ?>
+                <p class="wph-warn">⚠ <strong>Site Recovery</strong> is installed but inactive. <a href="<?php echo esc_url(admin_url('plugins.php')); ?>">Activate it</a> before starting work.</p>
+            <?php else: ?>
+                <p class="wph-bad">✗ <strong>Site Recovery</strong> is not installed. Install it before starting the healthcheck — it's the safety net while we work on the site.</p>
+                <p class="description">Phase-1: install manually via <em>Plugins → Add New → Upload Plugin</em>. A private update channel for one-click install lands in hc-5ix.27.</p>
+            <?php endif; ?>
+        </div>
+        <?php
+    }
+}