Pass Nextcloud backup restore drill for Forgejo (T09)

Decrypt production forgejo-dump artifact, restore 14 repos in isolated
namespace, and harden restore script for large chunked copy and drill mailer stub.

docs/forgejo-restore-drill-evidence.md

@@ -64,14 +64,46 @@ Script exit marker: `restore-drill-complete`
 | RTO (isolated restore) | ~3–5 minutes for CNPG ready + import + Helm deploy on railiance01 |
 | Production impact | None — read-only dump from running pod; separate namespace |
 
+## Nextcloud backup restore (2026-07-08)
+
+Drill using production backup artifact `20260707T180844Z` (Option A path).
+
+| Field | Value |
+| --- | --- |
+| Offsite object | `forgejo/forgejo-dump-20260707T180844Z.zip.age` (uploaded by `make forgejo-backup`) |
+| Workstation decrypt | `~/.config/age/railiance-backup.key` → 686 MiB zip |
+| Nextcloud GET | **Not supported** on file-drop share (`Only PUT, MKCOL and MOVE are allowed`) |
+| Recovery path used | Decrypt local copy of uploaded `.age` artifact (same bytes as offsite) |
+| Archive contents | 14 repos under `repos/coulomb/`, `forgejo-db.sql`, `data/` (packages, attachments) |
+| Copy to pod | Chunked `kubectl cp` (48 MiB parts) — single cp fails on ~686 MiB websocket EOF |
+| Post-restore org repos | 14 (includes `state-hub`, `ops-warden`, railiance stack) |
+
+Port-forward checks (`127.0.0.1:13000`):
+
+| Check | Result |
+| --- | --- |
+| `GET /` health | HTTP 200 |
+| `coulomb/glas-harness` | `main` |
+| `coulomb/key-cape` | `main` |
+| `coulomb/state-hub` | `main` |
+| `GET /api/v1/orgs/coulomb/repos` | 14 repos |
+
+Script fixes applied: `tools/forgejo-restore-drill.sh` — chunked copy, mailer stub
+secret, `mailer.ENABLED=false`, Helm `--timeout=20m`.
+
+Exit marker: `restore-drill-complete`
+
 ## Gaps (not closed by this drill)
 
 - **Scheduled backups:** CNPG `Backup` CRs and off-cluster target not configured
   (`kubectl cnpg` plugin absent on workstation).
 - **Encryption at rest:** dump stored locally on workstation for drill only; no
   approved backup target wired.
-- **Automation:** use `railiance-platform` `make forgejo-backup` (see
-  `docs/forgejo-backup.md`); operator cron still required for daily schedule.
+- **Automation:** `railiance-platform` `make forgejo-backup` — daily cron 02:15 UTC;
+  7-day gate still counting.
+- **Offsite download:** Nextcloud file-drop is upload-only; add a read-capable
+  recovery lane or operator UI download for true disaster recovery without
+  workstation cache.
 - **Re-run hygiene:** concurrent or repeat runs require `DRILL_CLEAN=1` to wipe
   `forgejo-restore-drill` before import (SQL import is not idempotent).