Python, 126 bytes

lambda s,g,o=[],*r:o*[9,1][s==g]if(0x558c8810>>s)&1|(s in r+(g,))else min([f(s^1<<i,g,o+[4-i],*r,s)for i in range(5)],key=len)

Attempt This Online!

Takes in integers, outputs one-indexed list. I'm a bit rusty, so I may have missed some obvious byte-savings.

Jelly, 31 bytes

5ṗⱮ6ẎṬ€^Że¡“¢Ƭi⁵Ñ0Ḥ’Bs5¤ɗƒ⁼³ʋƇḢ

A full program that accepts two arguments - the target followed by the source - and prints the one-indexed route to take to disarm the bomb in the fewest possible steps.

Try it online! (fairly slow, because it recomputes the invalid patterns at every application of an instruction and tries every instruction list up to length six for any inputs.)

How?

5ṗⱮ6ẎṬ€^Że¡“¢Ƭi⁵Ñ0Ḥ’Bs5¤ɗƒ⁼³ʋƇḢ - Main Link: target, source
5ṗⱮ6                           - {[1..5}] Cartesian power [{1..6]}
    Ẏ                          - tighten -> allInstructions
                                   = [[1],[2],[3],[4],[5],[1,1],[1,2],...,[5,5,5,5,5,5]]
                            Ƈ  - keep those for which:
                           ʋ   -   last four links as a dyad - f(instructions, source):
        Ṭ€                     -     untruth each of {instructions}
                        ƒ      -     start with {source} and reduce {that} by:
                       ɗ       -       last three links as a dyad - f(current, nextInstruction)
          ^                    -         XOR (vectorises) -> potentialNext
             ¡                 -         repeat...
            e                  -         ...times: exists in?:
                      ¤        -              nilad followed by link(s) as a nilad:
              “...’B           -                638111469824926 in binary
                    s5         -                split into chunks of five
           Ż                   -         ...action: prefix with a zero
                         ⁼³    -         equals the first program input (target)?
                             Ḣ - head
                               - implicit print

Uiua, 44 bytes

≡⊢≡⊚⧈≠⊢path(▽¬⤚˜∊≡⌟⍜⊏¬°⊏)𝄐≍:⋯-@A"E[_JZ^DLHP"

Try it!

"E[_JZ^DLHP"  # data string
⋯-@A         # subtract 'A' and convert to bits
:             # tuck under starting position
⊢path(        # find a shortest path by:
  ≡⌟⍜⊏¬°⊏    # getting each possible bit flip
  ▽¬⤚˜∊       # and keeping the valid ones
)𝄐≍           # until it matches the final state
⧈≠            # elem-wise difference between each step
≡⊢≡⊚         # get the bitflip location

Python3, 194 bytes

def f(a,b):
 q=[(a,b,[])]
 for a,b,c in q:
  if a==b:return c
  for i in range(len(a)):t=[*a];t[i]=int(not t[i]);q+=[(t,b,c+[i])]*(int(''.join(map(str,t)),2)not in[4,11,15,18,19,23,24,26,28,30])

Try it online!

Charcoal, 59 bytes

⊞υ⟦θ⟧Ｆυ¿¬ⅉ«≔⊟ιθ¿⁼θηＩιＦ⁵«≔⭆θ¬⁼Ｉλ⁼μκζ¿¬№⪪”)∧⊞ï{i↧#;”⁵ζ⊞υ⁺ι⟦κζ

Try it online! Link is to verbose version of code. Takes input as two bitstrings. Explanation:

⊞υ⟦θ⟧Ｆυ

Start a breadth-first search using the first input.

¿¬ⅉ«

Stop searching once an answer has been found.

≔⊟ιθ

Get the current bitstring.

¿⁼θηＩι

If this is the target, then output the sequence. Otherwise:

Ｆ⁵«

Loop over each possible bit.

≔⭆θ¬⁼Ｉλ⁼μκζ

Toggle that bit.

¿¬№⪪”...”⁵ζ⊞υ⁺ι⟦κζ

If the result is not in the compressed exclusion list then add it with the new sequence to the search list.

JavaScript (ES6), 101 bytes

Expects (source)(target) as 5-bit integers. Returns a string of indices.

s=>g=(t,m=b=0x558C8810,o,h=i=>i--?h(i,g(t^16>>i,m|1<<t,i+[o])):b)=>s^t?m>>t&1||h(5):o[b.length]?0:b=o

Try it online!

Try all possible inputs

Commented

s =>                 // outer function taking the source bitmask s
g = (                // g = inner recursive function taking:
  t,                 //   t = target bitmask
  m =                //   m = bitmask of forbidden patterns
  b = 0x558C8810,    //   b = best solution, initially not a string
  o,                 //   o = current solution
  h = i =>           //   h = helper recursive function taking i
  i-- ?              //   if i is not 0:
    h(               //     do a recursive call to h:
      i,             //       with i (decremented above)
      g(             //       and a recursive call to g:
        t ^ 16 >> i, //         pass the updated bitmask
                     //         where the bit 4-i of t is changed
        m | 1 << t,  //         mark the pattern t as forbidden
                     //         to prevent an infinite loop
        i + [o]      //         prepend i to o (*)
      )              //       end of recursive call
    )                //     end of recursive call
  :                  //   else (i = 0):
    b                //     return b
) =>                 //
s ^ t ?              // if s is not equal to t:
  m >> t & 1         //   if t is not forbidden,
  || h(5)            //   call h with i = 5
:                    // else:
  o[b.length] ?      //   if b is a string and shorter than o:
    0                //     do nothing
  :                  //   else:
    b = o            //     update b to o

_{(*) we do the reverse task (going from the target to the source), so the output must be reversed as well}

05AB1E, 42 39 bytes

∞ε5Lsã}€`.Δ¹šÅ»5LQ^}¤IQiJ•iÑ‹
•.¥4+båà≠

Input as two loose lists of bits; output-list is 1-based.

Try it online or verify all test cases.

Explanation:

∞                   # Push an infinite positive list: [1,2,3,...]
 ε                  # Map each to:
  5L                #  Push list [1,2,3,4,5]
    s               #  Swap so the current integer is at the top again
     ã              #  Cartesian product
 }€`                # After the map: Flatten one level down
.Δ                  # Then find the first list of indices that's truthy for:
  ¹š                #  Prepend the first input-list to the list of indices
    Å»              #  Cumulative left-reduce by, keeping intermediate results:
      5L            #   Push list [1,2,3,4,5] again
        Q           #   Equals check on the current index,
                    #   creating a list of five 0s, with a 1 at the index
         ^          #   Bitwise-XOR the bits in the lists at the same positions
    }               #  After the cumulative left-reduce:
     ¤              #  Push the final result (without popping the list of lists)
      IQi           #  If it's equal to the second input-list:
         J          #   Join the lists in the list together to binary strings
          •iÑ‹\n•   #   Push compressed integer 743141222
           .¥       #   Undelta its digits: [0,7,11,14,15,19,20,22,24,26]
             4+     #   Add 4 to each: [4,11,15,18,19,23,24,26,28,30]
               b    #   Convert each to a binary string
                åà≠ #   Check that none of these occur in the current list
                    # (after which the found result is output implicitly)

See this 05AB1E tip of mine (section How to compress large integers?) to understand why •iÑ‹\n• is 743141222