How similar is the Goldwasser-Sipser Set Lower Bound Protocol to the Hashcash/Bitcoin Proof-of-Work?
I can see some similarity too, but only in a loose sense; there are also some significant differences.

Here's the similarity.  Define $H_2(x)$ to be the first $d$ bits of $H(x||D)$.  Then you can think of the Bitcoin proof-of-work as being: find $x$ such that $H_2(x)=0$.  This is loosely similar to the Goldwasser-Sipser protocol; you could imagine that Merlin is the bitcoin miner and Arthur is the verifier, and the goal is for Merlin to prove to Arthur that Merlin has probably done at least about $2^{d-1}$ hash computations.  Or, if we let $S$ denote the set of values $x$ such that Merlin has computed $H_2(x)$, you could think of the goal being to prove that $|S|$ is at least $2^{d-1}$ or so.  Now if you imagine that Arthur always chooses $y=0$ in the Goldwasser-Sipser interactive proof, we get the same kind of computation.  So in that sense there is a similarity.

However, the correspondence is imperfect.  The threat models for the two schemes are quite different: Goldwasser-Sipser deals with a Merlin with unbounded computational power, whereas Bitcoin assumes the miner's computational power is limited.  The requirements for the hash function are quite different: Goldwasser-Sipser only needs a pairwise independent hash, whereas Bitcoin needs a cryptographically secure hash.  Also the nature of the set $S$ is different: in Goldwasser-Sipser the set $S$ is well-defined and there is a method specified in advance that Merlin can use to prove that a certain value is an element of the set, whereas in my analogy $S$ is only loosely defined and we don't have a clear way to prove that an element is a member of $S$.