feat(shares): R-7b Parts 1-2 — shares payload builder + tier-2 shares job (Model B')

Sibling shares source for the local cross-drive tier. Reuses the tier2Mirror seam,
selectTier2TargetFrom (narrow source-drive seam extracted from selectTier2Target),
tier2ReconcileRoots (pure extraction), tier2SafeRemove, the marker-LAST discipline
and the recordTier2* helpers. Per-app paths are untouched.

- shares_payload.go: deterministic _shares-manifest.json + best-effort passdb capture
- tier2_shares.go: per-source-drive legs -> cross-drive target, payload, marker LAST
- infra.SambaContainerName/SambaPassdbVolume/Mount: single source of truth for the
  container identity (renderer, stacks execs, backup execs, monitor all read it)
- RESERVED-NAME finding: ValidateSMBShareName did NOT exclude a leading underscore,
  so "_shares" was an accepted share name. Now refused; RunAllTier2 additionally
  skips a "_shares" stack loudly as defense in depth.
- fix: shareSourceDrive returned a slash-normalised path, which made the target
  selector's source-drive equality check miss (a group could target its own drive)

controller/internal/backup/backup.go

@@ -92,6 +92,15 @@ type Manager struct {
 	// (`-a --delete`, contents-of-src semantics).
 	tier2Mirror func(src, dst string) error
 
+	// sharesPassdbCapture (R-7b) — the samba passdb capture seam (a `docker exec … tar cf -`),
+	// overridable so the shares payload builder is unit-testable without docker. Nil → the real
+	// defaultSharesPassdbCapture. Best-effort by contract: an error yields a manifest-only payload.
+	sharesPassdbCapture func() ([]byte, error)
+
+	// sharesPassdbRestore (R-7b) — the mirror seam for putting a captured passdb archive BACK into the
+	// samba named volume (`docker exec -i … tar xf -`). Nil → the real defaultSharesPassdbRestore.
+	sharesPassdbRestore func(tar []byte) error
+
 	// tier2SSDFits (3b) — the SSD-headroom predicate seam, overridable in tests (system.GetDiskUsage is
 	// Linux-only → nil on the Windows test host, which would always refuse the SSD branch). Nil → the
 	// real tier2FitsSystemDrive.