[2/4] fix(runtime): make backups restore-safe

[MarcStdt]

Scope of this layer

Carry installed-release state through Docker/Kubernetes workers; serialize runtime maintenance, stage restoration, handle rollback failures, and resume maintenance-stopped queues for the intended restart.

Review order

Review runtime maintenance state and backup/restore workers before backend plumbing. This layer implements feature-specific maintenance behavior; it does not claim to fix the excluded general active-workload stop/requeue and backup-ownership problems.

Native GitHub stack #126, bottom to top:

1. [1/4] feat(registry): preserve release manifest #122 — feat(registry): preserve release manifest
2. [2/4] fix(runtime): make backups restore-safe #123 — fix(runtime): make backups restore-safe
3. [3/4] feat(runtime): apply accepted release digests #125 — feat(runtime): apply accepted release digests
4. [4/4] feat(runtime): validate releases and finalize lifecycle safeguards #124 — feat(runtime): validate releases and finalize lifecycle safeguards

GitHub's Files changed tab is incremental against the preceding branch. Review the complete stack before landing: later layers contain final fixes and cleanup for earlier layers. The old consolidated/superseded descriptions and draft acceptance notes are historical and replaced by this reconstruction.

Unchanged implementation

Reconstructed from existing commits only: no source edits, rebases, squashes or force-pushes. The complete stack tip is e4aadf2816bfec4f4642cf2ae130ca82401b5fd9, tree 7d6c9fb61e07900ec756fef2437b495c230a4585, exactly the previously verified local tree. Existing commits, discussion and PR identities are retained; only the runtime update boundary needed a new PR.

Verification and rollout

Local verification recorded on October 3 for the complete final implementation: 112 lifecycle/UI tests (11 opt-in skips in the default run); separate real Harbor/Postgres integration (2 passed); authenticated publisher import/retry/publication; SPA type-check; full CLI and engine commands; uncached publisher/workflow checks; focused race runs; rebuilt Docker/Kubernetes acceptance. Browser/workload evidence is complementary and qualified, not one uninterrupted end-to-end run. Four legacy Core compilation failures and the documented baseline active-workload backup/queue issues remain outside scope. These results do not assert every historical intermediate layer independently passed the final suite or that fresh remote CI is green.

See the final local requirement audit for exact commands, qualifications and rollout order. Ready for review does not mean merged or deployed. Matching Core/engine/runtime contracts must ship together; configure the public runtime API URL when GAME_HOST is not that API. Protected Team publishing environments/identity/secrets must exist before activating the workflow cutover; its fail-closed gate remains intact.

Companion changes: monorepo stack, runtime stack, standalone publisher. No production mutation or merge is part of this reconstruction.

[druid-infra]

Error: This repo is not allowlisted for Atlantis.

[MarcStdt]

Consolidated into #124, the single Unified Scroll runtime lifecycle review against master. Verified this PR head is an ancestor of #124 and the combined GitHub diff matches the full local lifecycle diff. Closing as superseded, not merged; code, commits, branch and discussion remain preserved. Continue review in #124.