Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/roles/s1_backup/templates/railiance-backup-s1.j2

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+exec python3 /usr/local/lib/railiance-infra/s1-backup/scripts/s1_backup.py create \
+  --source-revision "{{ railiance_backup_source_revision }}" "$@"

ansible/roles/s1_backup/templates/railiance-backup-s1.service.j2

@@ -0,0 +1,18 @@
+[Unit]
+Description=Encrypted Railiance S1 operating-system backup
+Documentation=file:///usr/local/lib/railiance-infra/s1-backup/spec/s1-backup.yaml
+After=local-fs.target
+ConditionPathIsReadWrite=/opt/backup/railiance/infra
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/railiance-backup-s1
+User=root
+Group=root
+UMask=0077
+Nice=10
+PrivateTmp=true
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/backup/railiance/infra

ansible/roles/s1_backup/templates/railiance-backup-s1.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily encrypted Railiance S1 backup (RAIL-HO-WP-0012-T04)
+
+[Timer]
+OnCalendar=*-*-* 02:15:00 UTC
+RandomizedDelaySec=30min
+Persistent=true
+Unit=railiance-backup-s1.service
+
+[Install]
+WantedBy=timers.target