fix(gitea): add full backup restore drill receipt path

apps/api/tests/test_gitea_full_server_backup_dr_receipts_api.py

@@ -65,7 +65,11 @@ def _payload() -> dict:
     )
 
 
-def _full_backup_metric_samples() -> list[dict]:
+def _full_backup_metric_samples(
+    *,
+    restore_drill_performed: bool = False,
+    production_restore_performed: bool = False,
+) -> list[dict]:
     def sample(name: str, value: float, **labels: str) -> dict:
         return {"name": name, "labels": {"host": "110", **labels}, "value": value}
 
@@ -73,8 +77,10 @@ def _full_backup_metric_samples() -> list[dict]:
         sample("awoooi_gitea_full_backup_last_run_failed", 0, service="gitea"),
         sample(
             "awoooi_gitea_full_backup_restore_drill_performed",
-            0,
+            1 if restore_drill_performed else 0,
             service="gitea",
+            drill_scope="structural_metadata_only",
+            production_restore="false",
         ),
         sample(
             "awoooi_gitea_full_backup_secret_value_collected",
@@ -83,7 +89,7 @@ def _full_backup_metric_samples() -> list[dict]:
         ),
         sample(
             "awoooi_gitea_full_backup_production_restore_performed",
-            0,
+            1 if production_restore_performed else 0,
             service="gitea",
         ),
     ]
@@ -130,10 +136,17 @@ def test_gitea_full_server_backup_dr_receipts_separates_bundle_from_full_dr() ->
     assert by_id["gitea_server_backup_target"]["status"] == "verified_ready"
     assert by_id["google_drive_offsite_mirror"]["status"] == "verified_ready"
     assert by_id["restore_drill_approval_gate"]["status"] == "approval_required"
+    assert by_id["restore_drill_approval_gate"]["receipt_state"] == (
+        "restore_drill_source_ready_live_receipt_pending"
+    )
+    assert by_id["restore_drill_approval_gate"]["metrics"][
+        "restore_drill_source_ready"
+    ] is True
     assert by_id["gitea_database_receipt"]["status"] == "source_ready"
     assert by_id["gitea_packages_receipt"]["status"] == "source_ready"
     assert by_id["gitea_attachments_receipt"]["production_restore_performed"] is False
     assert payload["source_contract"]["component_metric_writer_source_ready"] is True
+    assert payload["source_contract"]["restore_drill_source_ready"] is True
     assert payload["source_contract"]["secret_values_collected_by_source_inspection"] is False
 
 
@@ -155,6 +168,51 @@ def test_gitea_full_server_backup_dr_receipts_promotes_live_component_metrics()
     assert payload["receipt_metric_rollup"]["production_restore_performed"] is False
 
 
+def test_gitea_full_server_backup_dr_receipts_promotes_restore_drill_metric() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    payload = build_gitea_full_server_backup_dr_receipts(
+        repo_bundle_backup_readback=_repo_bundle_payload(),
+        backup_dr_readiness_matrix=load_latest_backup_dr_readiness_matrix(),
+        backup_dr_target_inventory=load_latest_backup_dr_target_inventory(),
+        source_contract=build_gitea_full_server_backup_source_contract(repo_root),
+        metric_samples=_full_backup_metric_samples(restore_drill_performed=True),
+        generated_at="2026-07-10T00:03:00+08:00",
+    )
+
+    assert payload["status"] == "gitea_full_server_backup_dr_receipts_ready"
+    assert payload["ready"] is True
+    assert payload["active_gap_ids"] == []
+    assert payload["summary"]["verified_ready_component_count"] == 10
+    assert payload["summary"]["restore_drill_source_ready"] is True
+    assert payload["summary"]["restore_drill_receipt_pending"] is False
+    by_id = {row["component_id"]: row for row in payload["component_rows"]}
+    assert by_id["restore_drill_approval_gate"]["status"] == "verified_ready"
+    assert by_id["restore_drill_approval_gate"]["metrics"][
+        "restore_drill_performed_metric"
+    ] is True
+    assert payload["receipt_metric_rollup"]["production_restore_performed"] is False
+
+
+def test_gitea_full_server_backup_dr_receipts_rejects_production_restore_metric() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    try:
+        build_gitea_full_server_backup_dr_receipts(
+            repo_bundle_backup_readback=_repo_bundle_payload(),
+            backup_dr_readiness_matrix=load_latest_backup_dr_readiness_matrix(),
+            backup_dr_target_inventory=load_latest_backup_dr_target_inventory(),
+            source_contract=build_gitea_full_server_backup_source_contract(repo_root),
+            metric_samples=_full_backup_metric_samples(
+                restore_drill_performed=True,
+                production_restore_performed=True,
+            ),
+            generated_at="2026-07-10T00:04:00+08:00",
+        )
+    except ValueError as exc:
+        assert "must not restore production" in str(exc)
+    else:
+        raise AssertionError("expected production restore metric to fail closed")
+
+
 def test_gitea_full_server_backup_dr_receipts_endpoint_returns_payload(monkeypatch) -> None:
     monkeypatch.setattr(
         agents,