Restore availability state from a verified backup

[gaborbernat]

Add preflight verification, isolated extraction, cluster-identity policy, single-node or quorum recovery flows, artifact checks, and post-restore protocol validation.

Scope

Restore must reject unsafe manifests and avoid reusing a live cluster or node identity. Start with crates/peryx/src/operator/restore.rs, verify.rs, and crates/peryx/src/tests/operator/restore_tests.rs.

Constraints

Exclude copying remote object-store bytes when the manifest can reference and verify durable objects; exclude an unsupported point-in-time promise. Record format version, cluster ID, control-plane index, metadata frontier, authority epochs, and artifact checksums. Reject mixed recovery points, stale control state, duplicate live cluster identity, and missing required artifacts. State the backup RPO and restore RTO assumptions. Bound extraction space and verification concurrency; record restore duration, bytes read, and service RTO.

Acceptance

• Corrupt, omitted, duplicated, and mixed components fail before target mutation (etcd recovery guide).
• Restored reads and writes preserve homes, epochs, serials, tags, frontiers, and placements (Amazon S3 checksum contract).
• Benchmarks report verification time, bytes read, restore duration, and service RTO.
• Document restore preflight, cluster identity, recovery paths, validation, and expected RTO.