fix: harden repository mutations and CLI safety

[postgresql007]

Summary

• fence repository mutations and prevent manifests from publishing references to missing chunks
• establish one repository-wide encryption domain so concurrent backup and WAL writers cannot create incompatible deduplication winners
• make control-plane backup and restore options explicit: supported verification and timeout settings are forwarded, unsupported local-only safety flags are rejected
• enforce read-only mode across rare mutating commands and reject negative retention counts and non-finite numeric options
• add focused regression coverage for corruption, dispatch, retention, and CLI validation paths

Verification

• go test ./internal/cli ./internal/capacity ./internal/backup/retention ./internal/repo/bundle ./internal/agent ./internal/server
• focused mutation-fence, encryption-domain, control-plane, read-only, retention, and numeric-option regression tests
• git diff --check

A local go test ./... run passed the affected packages and encountered three unrelated host-specific failures: invalid UTF-8 filename creation on macOS, PostgreSQL tool path precedence, and a test attempting to create /srv on a read-only filesystem.