Add native restic snapshot backend for encrypted deduplicating workstation backups

[CruxExperts]

Summary

Add a native restic snapshot backend to bbackup for encrypted, deduplicating workstation backups. This should be first-class bbackup functionality, not a wrapper script around restic.

Motivation

A workstation backup profile needs encrypted deduplicating snapshots, automatic Git repository discovery, retired-repository protection, restore/check workflows, machine-readable output, and scheduler integration. Restic already provides the encrypted deduplicating repository layer; bbackup should own the profile model, discovery, safety rules, scheduling, state ledger, and CLI surface.

Proposed scope

• Add a native config area such as snapshot_profiles.
• Add a restic snapshot engine.
• Add bbackup commands for snapshot init, snapshot run, snapshot check, snapshot restore, snapshot retire, snapshot purge-plan, and snapshot schedule.
• Support JSON output for planning, runs, health checks, purge plans, and restore/check operations.
• Support profile-level dependency checks in bbman health, including restic, rclone, remote reachability, password file permissions, cache directory, hostname guard, and repository initialization.
• Support automatic Git repository discovery from configured repo homes, plus explicitly configured repo roots.
• Preserve retired/deleted repository snapshots by default; never run broad restic forget across the whole profile repository.
• Maintain a bbackup state ledger of discovered repos, stable repo IDs/fingerprints, active/retired status, retirement time, and last successful snapshot IDs.
• Back up each discovered repo as its own restic snapshot with tags such as bbackup, profile=<name>, scope=repo, and repo_id=<id>.
• Restrict automated retention to active repo IDs and configured non-repo scopes only.
• Require dry-run-first manual purge planning for retired repos before any destructive forget/prune action.
• Provide restore and repository check commands suitable for smoke verification and scheduled maintenance.
• Provide schedule generation/install support, for example user systemd timers that call bbackup directly.
• Include unit and integration tests for config parsing, command construction, discovery, retired-repo protection, purge safety, hostname guard, dependency health, local restic repo init/backup/check/restore, and path-reuse/fingerprint conflicts.

Acceptance criteria

1. A native bbackup config can define a restic snapshot profile with repository URL, cache dir, state dir, password file, host ID, repo discovery roots, explicit roots, include paths, exclude paths, retention policy, and scheduling metadata.
2. CLI commands exist for snapshot init, snapshot run, snapshot check, snapshot restore, snapshot retire, snapshot purge-plan, and snapshot schedule.
3. Commands support human-readable and JSON output where appropriate.
4. bbman health reports profile-specific dependency and readiness status.
5. New Git repos under configured repo homes are included automatically without config edits.
6. Deleted repos are marked retired and excluded from automated retention when they have at least one successful snapshot.
7. Deleted repos without any successful snapshot produce a critical alert instead of being silently dropped.
8. Path reuse with a different Git fingerprint is detected and blocks history merging until manually resolved.
9. Automated retention never purges retired repos or runs broad profile-wide forget operations.
10. Manual purge requires a dry-run purge plan and explicit confirmation before destructive restic operations.
11. Restore and check workflows are covered by integration tests using a temporary local restic repository.
12. Scheduler generation supports daily backup, weekly maintenance, and monthly verification flows without overlapping runs.

Notes

For workstation backups using a cloud remote such as Google Drive through rclone, restic encryption is sufficient for content and metadata encryption. Additional rclone crypt wrapping should remain optional rather than required by the profile design.

[CruxExperts]

Status update from PR #5: #5

Acceptance checklist progress:

• Implemented: native snapshot_profiles, restic runner, snapshot init/run/check/restore/retire/purge-plan/schedule, JSON output, Git discovery, active/retired state ledger, stable repo IDs, dry-run-first retired repo purge plans, and profile health checks.
• Hardened in PR Harden native snapshot polish #5: legacy head-derived repo IDs migrate safely, unknown active same-path identity conflicts block history merging, scheduled units include matching services for daily/weekly/monthly flows, verification uses escaped --read-data-subset with a 5% default, and rclone Drive default-client use requires explicit profile opt-in.
• Added evidence: tests/integration/test_snapshot_restic.py initializes a temporary local restic repo, runs a snapshot of a temporary Git repo, runs snapshot check, restores into an empty directory, verifies restored content, and verifies the state ledger recorded the snapshot ID.
• Validation passed: version sync, publishing readiness, py_compile, git diff --check, snapshot unit tests, full non-integration test suite, local restic integration test, and systemd-analyze verify on rendered service/timer units.
• Docker integration remains unverified locally because the Docker socket returned permission denied; this should be covered by CI or a Docker-enabled maintainer environment.

Intentional remaining note:

• Automated destructive retention for retired repos remains dry-run-first/manual through snapshot purge-plan; no broad profile-wide forget/prune automation was added. I recommend keeping Add native restic snapshot backend for encrypted deduplicating workstation backups #3 open until maintainers confirm this satisfies the retention acceptance criteria or request a separate guarded retention implementation.

[CruxExperts]

Released the current native snapshot work in v1.8.5: https://github.com/CruxExperts/best-backup/releases/tag/v1.8.5

PR #5 is merged, CI is green, and the release workflow completed successfully with sdist and wheel assets uploaded. Additional release-gate hardening included no-origin path-reuse protection, path/env/user exclude expansion for restic, expanded restore target safety checks, dry-run failure signalling for alert/no-target snapshot plans, config-preserving schedule units, and health-check robustness.

Issue #3 should remain open for the remaining retention/purge acceptance decision. The released implementation keeps retired-repo cleanup dry-run-first/manual through snapshot purge-plan; automated active-retention/prune behavior was intentionally not added in this release.