fix(gitea): expose bundle backup restore readback

scripts/reboot-recovery/tests/test_reboot_p0_operational_contract.py

@@ -218,10 +218,13 @@ def test_backup_alerts_cover_188_gitea_mirror_subtree() -> None:
     assert 'awoooi_backup_coverage_domain_expected_info{host="188"}' in alerts
     assert "BackupCoverageDomainMetricMissing188" in alerts
     assert "awoooi_backup_coverage_domain_fresh == 0" in alerts
+    assert "GiteaPrivateBundleRestoreDryRunMissing" in alerts
+    assert "awoooi_gitea_bundle_sample_restore_dry_run_ok" in alerts
 
 
 def test_gitea_repo_bundle_backup_is_non_interactive_and_manifested() -> None:
     script = read("scripts/backup/gitea-repo-bundle-backup.sh")
+    restore_script = read("scripts/backup/gitea-bundle-sample-restore-dry-run.sh")
 
     assert "GIT_TERMINAL_PROMPT=0" in script
     assert "bundle create" in script
@@ -231,3 +234,7 @@ def test_gitea_repo_bundle_backup_is_non_interactive_and_manifested() -> None:
     assert "gitea dump" in script
     assert "does not replace `gitea dump`" in script
     assert "tokens or passwords" in script
+    assert "git clone --mirror --quiet" in restore_script
+    assert "fsck --connectivity-only" in restore_script
+    assert "awoooi_gitea_bundle_sample_restore_dry_run_ok" in restore_script
+    assert "never reads tokens" in restore_script