v0.6.0-rc1: slice 6 Phase A — backup + the self-restore-test (local target)

The guest-level backup layer + the journaled self-restore-test (restore→boot→verify→
teardown) that closes "a backup you haven't restored isn't a backup". All benign
(reuses the slice-4 classifier/gate/journal; no new destructive class/crypto). Local
target only; PBS = Phase B. Restore to a NEW guest only. Backups crash-consistent.

- proxmox: DestroyLXC, VzdumpOptions.Notes (notes-template), LatestBackupVolID.
- reconcile: Engine.RunRestoreTest (journal Scratch entry BEFORE mutation; net link-down
  pre-boot; defer teardown always; benign gated destroy) + Recover extended to reap a
  leaked scratch guest (Scratch flag, special-cased before the UPID path; idempotent).
- internal/backup: runner (vzdump + archive resolve + bulk-gap = backup!=1) + cadence
  scheduler (4th daemon goroutine, default 24h) + in-memory report store.
- hub: Backup/RestoreTest filled; collector seams; cross-repo golden byte-identical +
  bidirectional key-set tests; hub handler logs a FAILED restore-test prominently.
- config BackupConfig (band 990000-990009 default); --selftest=backup / restore-test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/engine_test.go

@@ -20,18 +20,24 @@ type fakeAPI struct {
 
 	startUPID, stopUPID, setUPID, resizeUPID string
 	startErr, stopErr, setErr, resizeErr     error
+	restoreUPID, destroyUPID                 string
+	restoreErr, destroyErr                   error
+	// status maps vmid -> the Guest returned by GuestStatus (default running if absent).
+	status map[int]proxmox.Guest
 	// waitFunc maps a UPID to a (status, err); default = OK. Mirrors the real client,
 	// which errors on a non-OK exitstatus.
 	waitFunc func(upid string) (proxmox.TaskStatus, error)
 	// statusFunc backs TaskStatusOnce (crash recovery); default = stopped/OK.
 	statusFunc func(upid string) (proxmox.TaskStatus, error)
 
-	starts  []int
-	stops   []int
-	sets    []setCall
-	resizes []resizeCall
-	waits   []string
-	listErr error
+	starts   []int
+	stops    []int
+	sets     []setCall
+	resizes  []resizeCall
+	restores []proxmox.RestoreLXCOptions
+	destroys []int
+	waits    []string
+	listErr  error
 }
 
 type resizeCall struct {
@@ -39,6 +45,29 @@ type resizeCall struct {
 	disk, size string
 }
 
+func (f *fakeAPI) RestoreLXC(_ context.Context, opts proxmox.RestoreLXCOptions) (string, error) {
+	f.mu.Lock()
+	f.restores = append(f.restores, opts)
+	f.mu.Unlock()
+	return f.restoreUPID, f.restoreErr
+}
+
+func (f *fakeAPI) DestroyLXC(_ context.Context, vmid int) (string, error) {
+	f.mu.Lock()
+	f.destroys = append(f.destroys, vmid)
+	f.mu.Unlock()
+	return f.destroyUPID, f.destroyErr
+}
+
+func (f *fakeAPI) GuestStatus(_ context.Context, vmid int) (proxmox.Guest, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if g, ok := f.status[vmid]; ok {
+		return g, nil
+	}
+	return proxmox.Guest{VMID: vmid, Status: "running"}, nil
+}
+
 func (f *fakeAPI) TaskStatusOnce(_ context.Context, upid string) (proxmox.TaskStatus, error) {
 	if f.statusFunc != nil {
 		return f.statusFunc(upid)