v0.6.0-rc1: slice 6 Phase A — backup + the self-restore-test (local target)

The guest-level backup layer + the journaled self-restore-test (restore→boot→verify→
teardown) that closes "a backup you haven't restored isn't a backup". All benign
(reuses the slice-4 classifier/gate/journal; no new destructive class/crypto). Local
target only; PBS = Phase B. Restore to a NEW guest only. Backups crash-consistent.

- proxmox: DestroyLXC, VzdumpOptions.Notes (notes-template), LatestBackupVolID.
- reconcile: Engine.RunRestoreTest (journal Scratch entry BEFORE mutation; net link-down
  pre-boot; defer teardown always; benign gated destroy) + Recover extended to reap a
  leaked scratch guest (Scratch flag, special-cased before the UPID path; idempotent).
- internal/backup: runner (vzdump + archive resolve + bulk-gap = backup!=1) + cadence
  scheduler (4th daemon goroutine, default 24h) + in-memory report store.
- hub: Backup/RestoreTest filled; collector seams; cross-repo golden byte-identical +
  bidirectional key-set tests; hub handler logs a FAILED restore-test prominently.
- config BackupConfig (band 990000-990009 default); --selftest=backup / restore-test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/proxmox/query.go

@@ -74,5 +74,28 @@ func (c *Client) StorageContent(ctx context.Context, store string) ([]StorageCon
 	return cs, c.get(ctx, path, &cs)
 }
 
+// LatestBackupVolID resolves the most recent vzdump archive for vmid on a backup storage.
+// It lists the store's content, keeps only backup archives for that vmid, and returns the
+// one with the greatest CTime. This is how a backup's produced archive is resolved after
+// Vzdump+WaitTask (the task status carries no result volid), and how the restore-test picks
+// a backup to restore. Returns ("", nil) when the guest has no archive on that store.
+func (c *Client) LatestBackupVolID(ctx context.Context, store string, vmid int) (string, error) {
+	contents, err := c.StorageContent(ctx, store)
+	if err != nil {
+		return "", err
+	}
+	var bestVol string
+	var bestCTime int64 = -1
+	for _, e := range contents {
+		if e.Content != "backup" || e.VMID != vmid {
+			continue
+		}
+		if e.CTime > bestCTime {
+			bestCTime, bestVol = e.CTime, e.VolID
+		}
+	}
+	return bestVol, nil
+}
+
 // urlEscape escapes a path segment (a UPID contains ':' and '@').
 func urlEscape(s string) string { return url.PathEscape(s) }