Complete DISCTL-WP-0003-T03 through T05

Add RTO-RPO matrix, backup pickup queue tracker, and TestEvidence
with Forgejo drill import. Mark T03, T04, T05 done.

TestEvidence/README.md

@@ -0,0 +1,54 @@
+# Test Evidence
+
+Dated restore-drill reports proving RTO/RPO targets in `RTO-RPO-Matrix.md` are
+actually met — not just documented.
+
+## Naming convention
+
+```text
+TestEvidence/restore-drill-YYYY-MM-DD-<system>.md
+```
+
+Examples: `restore-drill-2026-07-04-forgejo.md`
+
+## Required fields
+
+Every evidence file must include:
+
+| Field | Description |
+| --- | --- |
+| Date | Drill execution date (UTC) |
+| System | What was restored (register ID or system name) |
+| Backup artifact | Filename, size, timestamp, source (manual/automated) |
+| Target environment | Isolated namespace, staging host, clean VM, etc. |
+| Operator | Who ran the drill |
+| Result | `success` / `partial` / `failed` |
+| RPO achieved | Actual recovery point (how stale was the backup?) |
+| RTO achieved | Wall-clock time from start to validated service |
+| Checks performed | API calls, smoke tests, representative workflow |
+| Issues found | Anything that blocked or degraded restore |
+| Follow-up actions | Workplan items, pickup queue refs, register updates |
+| Canonical evidence | Link to owner-repo evidence if drill ran elsewhere |
+
+## Drill cadence
+
+| Tier | Minimum cadence | Owner |
+| --- | --- | --- |
+| T1 irreplaceable source of truth | Quarterly | Bernd |
+| T0 identity / trust | Quarterly (cold decrypt included) | Bernd |
+| T2 runtime platforms | Semi-annual | Bernd |
+
+Quarterly Forgejo drill gate: re-run `forgejo-restore-drill.sh` from an
+**automated** Nextcloud artifact once daily backups are wired (promotion gate
+in `BackupPolicy.md` §7).
+
+## Next untested targets
+
+Priority order after Forgejo manual drill (2026-07-04):
+
+1. **S2 k8s runtime** — decrypt `railiance-backup-s2` artifact on clean target;
+   validate Helm values redeploy
+2. **Dev workstation cold restore** — decrypt Nextcloud artifact without using
+   production key on same machine (password-manager key only)
+3. **Gitea dump** — manual `gitea dump` restore to staging before next migration wave
+4. **Secret vault cold decrypt** — SOPS/age recovery material (R5 mitigation)