Fix SIGTERM forwarding, harden image, restructure repo, add e2e CI tests

[modem7]

Summary

Signal handling

• Adds `borgmatic-start` wrapper at `/usr/local/bin/borgmatic-start` that traps `TERM`/`INT`/`HUP`, forwards the signal to borgmatic by PID, and waits for clean exit — prevents `docker stop` from killing borgmatic mid-backup and leaving a stale repo lock. Closes Update python Docker tag to v3.11.4 #104.
• Adds `stop_grace_period: 10m` to `docker-compose.yml` so Docker waits for borgmatic to finish.
• Warns at startup if the active crontab calls `borgmatic` directly instead of `borgmatic-start`.

Script hardening

• Replaces `eval`+`set | grep` secret expansion with safe `compgen -e` + bash indirect expansion (`${!var}`).
• Fixes `EXTRA_CRON` missing leading newline before append.
• Fixes post-loop debug labels printing "Before" instead of "After".
• `EXTRA_PKGS` split via `read -ra` instead of fragile unquoted word splitting.

Upstream sync (borgmatic-collective/docker-borgmatic)

• Adds `init-envfile` S6 oneshot service: processes `FILE__VARNAME` → writes secret file contents to container environment (LinuxServer.io convention).
• Alpine 3.23 → 3.24.
• `S6_CMD_WAIT_FOR_SERVICES_MAXTIME` reverted to `0` (upstream default: wait forever).

Repo restructure

• Moves everything from `base-fullbuild/` to repo root (matching upstream layout), preserving git history.
• Removes redundant `sync-drone-tags.yml` workflow (Drone now generates tags dynamically from `requirements.txt`).
• Removes Drone lint step (Hadolint + ShellCheck already run in GitHub Actions CI).
• Drone tag generation: replaces hardcoded version tags with a Prepare step that writes `.tags` from `requirements.txt`.

Renovate

• Extracts `ALPINE_VERSION` and `PYTHON_VERSION` as `ARG`s in the Dockerfile so Renovate can track each independently via `regexManagers`.

Config examples & documentation

• All example configs updated from borgmatic 1.x format to 2.x flat format.
• Hook examples updated from deprecated `before_everything`/`after_everything`/`on_error` to `commands:` syntax.
• `docker-compose.restore.yml` corrected: paths, `BORG_PASSPHRASE`, shell.
• `.env.template` updated: `BORG_RESTORE` replaces `VOLUME_RESTORE`, adds `VOLUME_BORGMATIC_STATE`.
• README rewritten: Configuration, Hook scripts, Healthchecks.io, signal handling, secret files, FUSE restore walkthrough.
• Adds `.gitignore` with `.claude`.

Example borgscripts

Three ready-to-use hook scripts in `data/borgscripts/` (all require `DOCKERCLI=true` + `docker.sock`):

• `docker-stop.sh`: stops containers carrying a configurable label (`backup` by default) before borgmatic runs. Label-based selection avoids hardcoding names; `--no-run-if-empty` guards against empty matches. Configurable label and stop timeout.
• `docker-start.sh`: starts a single compose stack after borgmatic using `docker compose start` (not `up -d`) to avoid unintended recreates. Configurable compose project directory.
• `redis-backup.sh`: triggers `BGSAVE` on a Redis container and polls `rdb_bgsave_in_progress` until the snapshot is written, so `dump.rdb` is consistent when borgmatic backs it up as a regular file. Configurable container name and timeout.
• README documents all three scripts with configuration variables, label setup, borgmatic hook wiring, and Docker requirements. New "Native database backup" section covers borgmatic's built-in PostgreSQL, MariaDB, MongoDB, and SQLite support.

CI — end-to-end tests

Four new tests that run borgmatic against a real Borg repository (no S6):

• Full backup/restore cycle: `repo-create` → `create` → `list` (assert archive count ≥ 1) → `borg extract` → verify file content on runner.
• `${VAR}` expansion in config: `source_directories` and `encryption_passphrase` read from container env vars.
• `encryption_passcommand`: passphrase read from a mounted secrets file via `cat /run/secrets/passphrase`.
• Invalid config rejection: `borgmatic config validate` must exit non-zero for a config with wrong type.

What reviewers should know

• Users with a custom `CRON_COMMAND` or `crontab.txt` calling `borgmatic` directly will see an advisory warning at startup — nothing breaks, but they should switch to `borgmatic-start` for signal forwarding.
• `borgmatic-start` passes all arguments through (`"$@"`), transparent drop-in replacement.
• The `FILE__VARNAME` convention from `init-envfile` is distinct from the existing `BORG_FILE` / `YOUR_FILE` expansion — both coexist.
• `docker-stop.sh` stops by label only — it does not stop the whole compose stack. `docker-start.sh` starts the whole stack. Users who want to stop the entire stack should wire `docker compose --project-directory ... stop` directly.
• `redis-backup.sh` covers the default RDB persistence mode. If Redis uses AOF (`appendonly yes`), stop the container instead (add the `backup` label to the Redis service).

Test plan

• Container starts cleanly with no `CRON` set (default schedule used)
• Container starts cleanly with `CRON` env var set
• `BORG_PASSPHRASE_FILE` / `YOUR_*_FILE` secret expansion works correctly
• `EXTRA_PKGS` with multiple space-separated packages installs all of them
• `DEBUG_SECRETS=true` shows correct Before/After labels
• Warning appears when crontab contains `borgmatic` directly
• No warning appears when crontab uses `borgmatic-start`
• `borgmatic config validate` passes on the shipped `config.yaml`
• `borgmatic config validate` fails on invalid config (CI: automated)
• Full backup cycle against a real Borg repo: repo-create, create, list (assert archive count), borg list (assert expected files present in archive) (CI: automated)
• `${VAR}` expansion in borgmatic config works end-to-end (CI: automated)
• `encryption_passcommand` via mounted secrets file works (CI: automated)
• `docker stop` during a running backup sends SIGTERM to borgmatic (check logs for "Caught signal")
• `FILE__VARNAME` → env var expansion works at container startup
• Renovate correctly tracks Alpine and Python version bumps separately
• `docker-stop.sh` stops only labelled containers, leaves unlabelled ones running
• `docker-start.sh` restores stopped containers without recreating them
• `redis-backup.sh` completes before borgmatic starts (check log ordering)

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[modem7]

These were dummy CI test passphrases with no real credentials behind them. Extracted all three to job-level env: vars (BORG_CI_PASSPHRASE, BORG_CI_PASSPHRASE_ENVVAR, BORG_CI_PASSPHRASE_CMD) in df74c34 so no literal strings appear inline.