Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

.forgejo/workflows/ci-smoke.yaml

@@ -21,7 +21,7 @@ jobs:
         run: |
           set -eu
           apt-get update
-          apt-get install -y --no-install-recommends make python3 python3-yaml
+          apt-get install -y --no-install-recommends age make python3 python3-yaml
       - name: Validate S1 source contracts
         run: |
           set -eu
@@ -31,6 +31,7 @@ jobs:
           python3 scripts/handoff_contract.py
           python3 scripts/sops_rotation.py --check
           python3 scripts/s1_receipt.py docs/evidence/s1-receipts/*.json
+          python3 scripts/s1_backup.py check
           python3 -m unittest discover -s tests -v
           make check-secrets