Add strict no-clobber restore

[frahlg]

Summary

• add ftw restore <backup> <absent-target> with versioned JSON output
• verify the source, hidden stage, and published target read-only
• reject recovered raw tails, stale active rollups, corrupt selected files, symlinks, and special files
• publish restore and backup directories with atomic no-clobber rename
• roll back publication failures while the stage shared lock remains held
• add a restore drill after the Linux NBD power-loss check

Safety contract

Restore copies only active.wlog, the selected manifest, and its active immutable rollups. It ignores orphan and older derived files. A deterministic CRC32 covers sorted relative paths, file lengths, and exact bytes.

An existing target, including an empty directory, remains unchanged. Linux and Apple builds use rustix::fs::renameat_with with RenameFlags::NOREPLACE; unsupported targets fail closed.

If the final parent sync or post-check fails, FTWDB verifies the published directory identity and rolls its own directory back while its shared store lock stays live. If rollback also fails, SnapshotPublication reports that state instead of hiding a visible target.

CRC32 checks byte equality, not authenticity. Restore does not repair or salvage corrupt input; salvage stays in the next PR.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features --locked --offline -- -D warnings
• cargo test --all-targets --all-features --locked --offline
• cargo test --doc --locked --offline
• emulator build, fmt, Clippy, and tests with locked offline dependencies
• shell syntax checks and git diff --check
• sanitized fixture restore: 889,978 points, 89 commits, snapshot CRC32 9ff1a95b
• privileged OrbStack ARM64 Linux NBD power-loss and restore drill: passed
• privileged 64 MiB NBD full-disk test: expected ENOSPC, checked 770,000-point/77-commit prefix