v0.6.0-rc1: slice 6 Phase A — backup + the self-restore-test (local target)

The guest-level backup layer + the journaled self-restore-test (restore→boot→verify→
teardown) that closes "a backup you haven't restored isn't a backup". All benign
(reuses the slice-4 classifier/gate/journal; no new destructive class/crypto). Local
target only; PBS = Phase B. Restore to a NEW guest only. Backups crash-consistent.

- proxmox: DestroyLXC, VzdumpOptions.Notes (notes-template), LatestBackupVolID.
- reconcile: Engine.RunRestoreTest (journal Scratch entry BEFORE mutation; net link-down
  pre-boot; defer teardown always; benign gated destroy) + Recover extended to reap a
  leaked scratch guest (Scratch flag, special-cased before the UPID path; idempotent).
- internal/backup: runner (vzdump + archive resolve + bulk-gap = backup!=1) + cadence
  scheduler (4th daemon goroutine, default 24h) + in-memory report store.
- hub: Backup/RestoreTest filled; collector seams; cross-repo golden byte-identical +
  bidirectional key-set tests; hub handler logs a FAILED restore-test prominently.
- config BackupConfig (band 990000-990009 default); --selftest=backup / restore-test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/reconcile/state.go

@@ -114,6 +114,14 @@ type GuestAPI interface {
 	SetConfig(ctx context.Context, vmid int, params map[string]string) (string, error)
 	// ResizeLXC grows a volume (grow-only; the planner never emits a shrink). Async → UPID.
 	ResizeLXC(ctx context.Context, vmid int, disk, size string) (string, error)
+	// RestoreLXC restores an archive into a (fresh) vmid — the create path (slice 6). Async → UPID.
+	RestoreLXC(ctx context.Context, opts proxmox.RestoreLXCOptions) (string, error)
+	// DestroyLXC destroys a guest — the scratch-teardown primitive (slice 6). Async → UPID.
+	// Destructive-class; the engine only ever issues it for an agent-tagged scratch guest
+	// (benign by provenance) via the gate.
+	DestroyLXC(ctx context.Context, vmid int) (string, error)
+	// GuestStatus reads a single guest's current status (run-state poll during a restore-test).
+	GuestStatus(ctx context.Context, vmid int) (proxmox.Guest, error)
 	WaitTask(ctx context.Context, upid string, opts proxmox.WaitOptions) (proxmox.TaskStatus, error)
 	// TaskStatusOnce is a single non-blocking task-status read — used by crash
 	// recovery to learn the outcome of an op that was in flight when the agent died.