Add one-command server and client bootstraps

README.md

@@ -43,6 +43,7 @@ accepted the credential.
 
 Operational documentation:
 
+- [One-command server recovery and client enrollment](docs/bootstrap-recovery.md)
 - [Broker location, health, timeout, and recovery](docs/broker-operations.md)
 - [Windows domain join and remote-access onboarding](docs/windows-client-onboarding.md)
 - [Required Credential Provider client enrollment](docs/client-enrollment.md)
@@ -94,6 +95,20 @@ Follow [docs/lab-runbook.md](docs/lab-runbook.md). Review
 Never disable the built-in Microsoft password Credential Provider. It is the
 supported recovery path if a third-party provider fails to load.
 
+For a clean machine, the supported entry points are the release packages:
+
+```bat
+Start-SguServerBootstrap.cmd 192.168.50.10
+Start-SguClientEnrollment.cmd 192.168.50.10
+```
+
+The server command creates a new forest and resumes by itself after its required
+restart. The client command registers a unique non-exportable mTLS certificate,
+installs and validates SGU before domain join, then enables the managed remote
+access configuration after restart. See
+[bootstrap-recovery.md](docs/bootstrap-recovery.md) for edition limitations,
+network parameters, security properties, and release publication.
+
 ## Upstream license
 
 The Lithnet source remains under its MIT license in [LICENSE](LICENSE). Project