v0.76.0: campaign-#3 hardening (settings .bak recovery, restore stack_name validation, quiesce marker quarantine)

S1: corrupt settings.json recovers from .bak / safe-defaults+preserve, no crash-loop.
F2: validStackName gates restore + export handlers (reject /,\,..,NUL traversal).
S3: corrupt quiesce marker logged + quarantined, not silently dropped.
Tests T-S1/F2/S3 + red-proofs. Agent/hub untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/quiesce/quiesce.go

@@ -319,7 +319,12 @@ func (l *Loop) readMarker() (Marker, bool) {
 		return Marker{}, false
 	}
 	var m Marker
-	if json.Unmarshal(data, &m) != nil {
+	if err := json.Unmarshal(data, &m); err != nil {
+		// S3: a corrupt marker is NOT silently dropped — log it LOUD and quarantine the bad file (a real
+		// corrupted-mid-quiesce marker would otherwise skip stack-recovery with no trace). Still return
+		// false: "no usable marker" ⇒ no recovery is the correct contract.
+		l.logger.Printf("[WARN] [quiesce] marker at %s is corrupt (%v) — quarantining; stacks not auto-recovered from it", l.markerPath, err)
+		_ = os.Rename(l.markerPath, fmt.Sprintf("%s.corrupt-%d", l.markerPath, l.now().Unix()))
 		return Marker{}, false
 	}
 	return m, true