fix(#549,#551): verify plaintext archives before restore; clean up + restart on backup failure

[VijitSingh97]

Closes #549
Closes #551

Summary

Two companion backup/restore failure-path fixes in the pithead CLI:

• restore: plaintext archives extract without integrity verification — a truncated backup half-overwrites config/keys #549 — restore: the plaintext branch of stack_restore extracted with sudo tar -xzf and no integrity check, so a truncated pre-Encrypt pithead backup archives with a passphrase (openssl enc), decrypt on restore #374 archive aborted mid-extraction with config/keys half-overwritten. The fix mirrors the encrypted branch's full-stream verify: tar -tzf "$archive" over the whole archive before extraction, refusing with the same integrity-error message and nothing written.
• backup: a failed archive leaves the stack stopped and (plaintext) a partial archive that looks valid #551 — backup: the plaintext sudo tar in stack_backup was unguarded — a failure tripped errexit, stranding a stopped stack and leaving a partial root-owned archive that looks valid. Both branches' failure paths now remove the partial archive, restart the stack when it was running (was_running=1), then error out with the cause. The explicit if ! style already used by the encrypted branch — no ERR traps. Success path unchanged.

Docs: docs/operations.md backup/restore section updated to state both behaviours.

Test evidence

Tier-1 (tests/stack/run.sh), full suite green with the fixes (run twice pre-rebase, backup/restore blocks re-verified post-rebase): 1273 passed, 0 failed.

New assertions, all passing with the fixes:

✓ truncated plaintext archive exits non-zero
✓ truncated plaintext archive names integrity failure
✓ truncated plaintext archive leaves config.json untouched
✓ truncated plaintext archive leaves .env untouched
✓ failed plaintext backup (running stack) exits non-zero
✓ failed plaintext backup names the cause
✓ failed plaintext backup leaves no archive behind
✓ failed plaintext backup restarts the stack

Revert-proof (fixes reverted to develop's pithead, tests kept):

✗ truncated plaintext archive names integrity failure   (tar aborts mid-extraction: "truncated gzip input", on_err fires)
✗ failed plaintext backup names the cause               (errexit fires straight through, no cleanup message)
✗ failed plaintext backup restarts the stack            (docker log has "compose down" but no "compose up")

make lint passes on every surface except lint-proto, which needs the Docker daemon (not running on this dev box) — unrelated to this change. make lint-sh, lint-md, lint-docs-voice all clean.

🤖 Generated with Claude Code