refactor(restore): canonicalize and coordinate untrusted restores

[SaladDay]

Status

Draft handoff only. This branch is intentionally not ready to merge. Implementation work stopped before the final capability-gate audit, complete regression pass, and blind-review convergence.

What this explores

• Rebuild untrusted SQL or database input into a typed canonical stage.
• Publish the complete canonical database through the SQLite Backup API.
• Coordinate database publication, Skills replacement, crash recovery, live projection, and TUI generation tokens.
• Bound untrusted files and SQL execution, reject unsafe archive paths, and validate source schemas before migration.
• Move restore work off the TUI thread.
• Preserve local Skills for local restores while requiring exact database and ZIP agreement for cloud bundles.

Related to #391.

Evidence so far

• Current head: cargo fmt --check, cargo check --tests, and git diff --check pass.
• Earlier stable point: 4,134 library tests passed; focused restore, database, sync, provider, daemon, and command suites passed.
• A 57,048,540-byte real export completed in about 10.5-11.3 seconds at about 74 MiB peak RSS on the test host. This is not yet an apples-to-apples origin/main benchmark.

Remaining before merge

• Complete the operation-scoped capability audit, including known nested acquisition in cli/commands/proxy.rs.
• Re-run the full sandboxed suite, test-hooks, clippy, Windows/WAL checks, and final benchmark.
• Run the required independent blind-review protocol and resolve confirmed findings.

The complete design, invariants, evidence, and continuation checklist are in docs/canonical-restore-redesign-handoff.md.

Upstream reference pin: 3fa6b1f158b4e609b1588affb366bd90fb11878e from feat/pi-native-support, including 28530ff6 and subsequent migration-source work.