[Verify] Backup integrity verification (opt-in, per-Backup)

[payamQorbanpour]

Imported from gobackup#94 — originally opened by @aminmr on 2026-07-08.

Part of gobackup#81. Depends on gobackup#92 (shares download/decrypt/decompress).

Summary

Optional per-Backup integrity check: after a successful backup run, re-download the artifact and confirm it decrypts, decompresses, and matches its checksum — catching silent corruption and truncated uploads.

Scope

• spec.verify.integrity (opt-in) on the Backup CRD.
• Post-run verification Job that reuses the runner's download/decrypt/decompress path (no DB needed) and validates checksum + successful decode.
• Surface the result as a status condition (BackupIntegrity) + a Prometheus metric.

Out of scope

• Actual restore into a DB (that is restore-mode / scheduled test-restore).

Acceptance criteria

• A corrupted/truncated artifact flips the BackupIntegrity condition to False and increments a failure metric.
• Healthy backups report the condition True; the feature is off by default.