fix(gitea): expose bundle backup restore readback

ops/monitoring/alerts-unified.yml

@@ -1581,6 +1581,23 @@ groups:
           description: "Gitea private bundle manifest、bundle、checksum 或 freshness 有缺口；public repo search 不能代表完整備份。"
           runbook: "先讀 awoooi_gitea_bundle_* 指標找缺少的 repo，執行 scripts/backup/gitea-repo-bundle-backup.sh 產生 bundle 並同步到 188；不得刪 repo、不得 restore 到 production、不得讀 token。"
 
+      - alert: GiteaPrivateBundleRestoreDryRunMissing
+        expr: absent(awoooi_gitea_bundle_sample_restore_dry_run_ok{host="188"}) or awoooi_gitea_bundle_sample_restore_dry_run_ok{host="188"} == 0
+        for: 30m
+        labels:
+          severity: critical
+          layer: host-backup
+          component: gitea-private-bundle
+          host: "188"
+          team: ops
+          alert_category: infrastructure
+          notification_type: TYPE-3
+          auto_repair: "false"
+        annotations:
+          summary: "188 Gitea private repo bundle 還原 dry-run 未通過"
+          description: "Gitea bundle 備份需要 sample restore dry-run 證明可還原；bundle 存在不等於 restore confidence。"
+          runbook: "在 188 執行 scripts/backup/gitea-bundle-sample-restore-dry-run.sh --repo wooo/awoooi --write-textfile；只允許暫存目錄 dry-run，不得 restore 到 production，不得刪 repo，不得讀 token。"
+
       - alert: BackupCoverageDomainStale
         expr: awoooi_backup_coverage_domain_fresh == 0
         for: 15m

ops/runner/test_cd_controlled_runtime_profile.py

@@ -157,7 +157,9 @@ def test_backup_freshness_sources_stay_on_controlled_runtime_profile() -> None:
         "scripts/backup/backup-awoooi-frequent.sh)",
         "scripts/backup/backup-status.sh)",
         "scripts/backup/gitea-repo-bundle-backup.sh)",
+        "scripts/backup/gitea-bundle-sample-restore-dry-run.sh)",
         "scripts/backup/tests/test_backup_status_contract.py)",
+        "scripts/backup/tests/test_gitea_bundle_sample_restore_dry_run.py)",
         "scripts/ops/backup-alert-label-contract-check.py)",
         "scripts/ops/backup-health-textfile-exporter.py)",
         "scripts/ops/tests/test_backup_health_textfile_exporter.py)",
@@ -172,7 +174,9 @@ def test_backup_freshness_sources_stay_on_controlled_runtime_profile() -> None:
         "scripts/ops/tests/test_alertmanager_webhook_config.py)",
         "../../scripts/backup/backup-awoooi-frequent.sh",
         "../../scripts/backup/backup-status.sh",
+        "../../scripts/backup/gitea-bundle-sample-restore-dry-run.sh",
         "../../scripts/backup/tests/test_backup_status_contract.py",
+        "../../scripts/backup/tests/test_gitea_bundle_sample_restore_dry_run.py",
         "../../scripts/ops/backup-alert-label-contract-check.py",
         "../../scripts/ops/gitea-queue-hook-backlog-playbook.py",
         "../../scripts/ops/host-runaway-process-exporter.py",
@@ -774,8 +778,10 @@ def test_gitea_private_inventory_scorecard_stays_on_controlled_runtime_profile()
         "apps/api/src/services/gitea_owner_coverage_attestation_validation.py)",
         "apps/api/src/services/gitea_private_inventory_closeout_validation.py)",
         "apps/api/src/services/gitea_private_inventory_p0_scorecard.py)",
+        "apps/api/src/services/gitea_repo_bundle_backup_readback.py)",
         "apps/api/src/services/gitea_workflow_runner_owner_attestation_request.py)",
         "apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py)",
+        "apps/api/tests/test_gitea_repo_bundle_backup_readback_api.py)",
         "apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py)",
         "docs/operations/awoooi-gitea-authenticated-inventory-payload-validation.snapshot.json)",
         "docs/security/GITEA-REPO-INVENTORY-SNAPSHOT.md)",
@@ -788,8 +794,10 @@ def test_gitea_private_inventory_scorecard_stays_on_controlled_runtime_profile()
         "src/services/gitea_owner_coverage_attestation_validation.py",
         "src/services/gitea_private_inventory_closeout_validation.py",
         "src/services/gitea_private_inventory_p0_scorecard.py",
+        "src/services/gitea_repo_bundle_backup_readback.py",
         "src/services/gitea_workflow_runner_owner_attestation_request.py",
         "tests/test_gitea_private_inventory_p0_scorecard_api.py",
+        "tests/test_gitea_repo_bundle_backup_readback_api.py",
         "tests/test_gitea_workflow_runner_owner_attestation_request_api.py",
         "scripts/security/tests/test_gitea_authenticated_inventory_payload_validator.py)",
         "../../scripts/security/gitea-private-inventory-p0-scorecard.py",