Implement governed S1 backup recovery loop

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

spec/s1-backup.yaml

@@ -0,0 +1,53 @@
+schema_version: "1.0"
+
+backup_root: /opt/backup/railiance/infra
+recipient_policy: .sops.yaml
+recipients:
+  - age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
+
+retention:
+  keep_complete_bundles: 7
+  max_total_bytes: 268435456
+  freshness_hours: 26
+
+artifacts:
+  os-config:
+    format: tar.gz
+    paths:
+      - path: /etc/ssh/sshd_config
+        required: true
+        expected_mode: "0644"
+      - path: /etc/ssh/sshd_config.d
+        required: false
+      - path: /etc/ufw/ufw.conf
+        required: false
+      - path: /etc/ufw/user.rules
+        required: false
+      - path: /etc/ufw/user6.rules
+        required: false
+      - path: /etc/fail2ban/jail.local
+        required: false
+      - path: /etc/fail2ban/jail.d
+        required: false
+      - path: /etc/hosts
+        required: true
+        expected_mode: "0644"
+      - path: /etc/hostname
+        required: true
+        expected_mode: "0644"
+      - path: /etc/apt/sources.list.d
+        required: false
+  packages:
+    format: dpkg-selections
+    command: [dpkg, --get-selections]
+
+excluded_prefixes:
+  - /etc/age
+  - /etc/kubernetes
+  - /etc/rancher
+  - /etc/sops
+  - /etc/ssl/private
+  - /home
+  - /root
+  - /var/lib/kubelet
+  - /var/lib/rancher