Decrypt production forgejo-dump artifact, restore 14 repos in isolated
namespace, and harden restore script for large chunked copy and drill mailer stub.
Add isolated-namespace restore drill (CNPG cluster, PVC, orchestration script)
and document successful 2026-07-04 run: production forgejo dump restored with
health 200 and pilot repos visible via API. Scheduled backups remain open.
Per ADR-003: cloud-init (S1 node provisioning) and host planning tool
belong at the Infrastructure Substrate layer. Moved from railiance-cluster.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>