Prepare governed S1 offsite upload

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

ansible/roles/s1_backup/tasks/main.yml

@@ -29,6 +29,7 @@
   loop:
     - s1_backup.py
     - s1_backup_contract.py
+    - s1_offsite.py
     - s1_restore.py
 
 - name: Install S1 backup declaration
@@ -39,6 +40,17 @@
     group: root
     mode: "0644"
 
+- name: Install pending-owner S1 off-site contract metadata
+  ansible.builtin.copy:
+    src: "{{ playbook_dir }}/../../spec/{{ item }}"
+    dest: "/usr/local/lib/railiance-infra/s1-backup/spec/{{ item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop:
+    - s1-offsite.yaml
+    - s1-offsite-owner-acceptance.yaml
+
 - name: Install public recipient policy metadata
   ansible.builtin.copy:
     src: "{{ playbook_dir }}/../../.sops.yaml"