Fix readiness load and add disaster recovery gate

[crypt0rr]

Summary

• bound unauthenticated readiness writer probes with single-flight caching and a strict deadline
• add focused concurrency, failure, and cancellation coverage
• add an isolated Docker disaster-recovery rehearsal that exercises backup/restore, checksum enforcement, wrong-key rejection, restart persistence, and signal cleanup
• require the rehearsal before Docker publication and release v0.63.0 documentation

Validation

• go test -p 1 -timeout 30m ./... -count=1
• go test -race -p 1 -timeout 30m ./... -count=1
• go vet ./...
• make coverage
• make lint vuln
• scripts/disaster-recovery-smoke.sh against a local Docker image

Closes #302
Closes #303