NA-0286: add qsl-attachments backup restore recovery harness

[Tebbens4832]

Goals: G1, G3, G4, G5

Impact: Adds the executable qsl-attachments backup / partial restore / transactional recovery harness for NA-0286.

No-regression: Preserves the opaque-ciphertext boundary, resource-scoped capabilities, fail-closed partial restore behavior, existing reject-taxonomy, retention/recovery, disk/quota, and capability harnesses, and avoids dependency/workflow changes.

Tests/Vectors: Added tests/backup_restore_recovery.rs and tests/backup_restore_logging.rs; validated targeted harnesses, full cargo test --locked, cargo clippy --locked --all-targets -- -D warnings, and cargo audit --deny warnings.

This PR adds the executable qsl-attachments backup / partial restore / transactional recovery harness.

Implementation code changed: no. Source changes are test-only.
No dependency changes in harness PR.
No workflow changes.
No production-readiness claim.
Loopback/local/tempdir tests only.
Cold full-root copy semantics only.
Hot/live backup unsupported.
Partial restore fail-closed.
Rejected/expired/deleted/aborted state does not resurrect.
Backup/restore logs do not leak capabilities/descriptors/ciphertext/plaintext.
Opaque-ciphertext boundary preserved.
qsl-protocol evidence will be recorded separately.

Chosen semantics:

• Cold full-root restore copies the entire storage root while quiesced and starts a new AppState with matching config.
• Coherent committed objects remain fetchable when object.json and ciphertext.bin match.
• Coherent open sessions remain best-effort resumable when session.json and journaled parts match.
• Partial/mixed/incoherent restore fixtures fail closed and are not exposed as objects or plaintext.
• Mismatched object metadata and missing object/session pair sides are discarded or rejected fail-closed.

Validation:

• cargo fmt --check
• cargo test --locked --test service_contract -- --test-threads=1
• cargo test --locked --test reject_taxonomy_harness -- --test-threads=1
• cargo test --locked --test retention_cleanup_recovery -- --test-threads=1
• cargo test --locked --test retention_cleanup_logging -- --test-threads=1
• cargo test --locked --test disk_pressure_quota_abuse -- --test-threads=1
• cargo test --locked --test disk_pressure_quota_logging -- --test-threads=1
• cargo test --locked --test capability_scope_abuse -- --test-threads=1
• cargo test --locked --test capability_scope_logging -- --test-threads=1
• cargo test --locked --test backup_restore_recovery -- --test-threads=1
• cargo test --locked --test backup_restore_logging -- --test-threads=1
• cargo test --locked
• cargo clippy --locked --all-targets -- -D warnings
• cargo audit --deny warnings
• git diff --cached --check
• direct overclaim and secret-pattern scans over changed files