Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/playbooks/s1-backup.yaml

@@ -0,0 +1,20 @@
+---
+# Mutating deployment surface for RAIL-HO-WP-0012-T04. This playbook is not
+# included by bootstrap or verification and requires an exact operator token.
+- hosts: all
+  become: true
+  vars_files:
+    - ../inventory/group_vars/all.yaml
+  pre_tasks:
+    - name: Require exact approval for S1 backup timer deployment
+      ansible.builtin.assert:
+        that:
+          - railiance_backup_deploy_approval | default('') == 'DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER'
+          - railiance_backup_source_revision | default('') is match('^[0-9a-f]{40}$')
+        fail_msg: >-
+          Refusing host mutation. Set
+          railiance_backup_deploy_approval=DEPLOY-RAIL-HO-WP-0012-S1-BACKUP-TIMER
+          and a 40-character railiance_backup_source_revision after reviewing
+          this play and its rendered units.
+  roles:
+    - role: s1_backup