Native: offline backup-hold console commands (release, inspect) for restore #973

Requested by Cloud (cloud#591, which wires #953 into native cells).

Problem

Cloud's restore import releases the restored (lapsed) backup hold while the cell is deliberately offline, before any Server process starts. On PHP that is a one-off artisan external-payloads:backup-hold release --owner=<uuid> console container. Native has only #953's HTTP endpoints, so the import-time release fails closed and native restore is blocked.

Change

Offline subcommands on the native binary, alongside schema-bootstrap and schema-upgrade:

• backup-hold release --owner <uuid>
• backup-hold inspect [--owner <uuid>]

Each uses the DB settings only (DB_CONNECTION and related variables), starts no listener or workers, and prints the same durable-workflow.external-payload-backup-hold.v1 report as #953's endpoints. Failures exit non-zero with the same refusal reason.

Acceptance

• Same code path as Native: online-backup hold endpoints, with PHP's deletion fence #953's change_backup_hold(Release) and backup_hold_status: idempotent, recorded-owner semantics, database clock.
• Releasing a lapsed restored hold by its recorded owner succeeds and is recorded. A second release is idempotent. A different owner is refused exactly as the endpoint refuses it.
• inspect is read-only.
• Tests run on SQLite, PostgreSQL and MySQL, and an installed-image check runs the command in a one-off container with no Server process.
• Argument parsing accepts only these forms; every other subcommand still takes no arguments.

Review tier A: data retention (payload reclamation hold).

Target: a 3.0.x patch after 3.0.2. Not needed for 3.0.2, since capture works through the endpoints.