fix: harden backup shutdown and release integrity

[WilliamWang1721]

Security and reliability fixes

Remove rollback-capable recovery workflow

• removed the one-shot release-v0361-recovery.yml from main immediately
• no manual or push trigger remains that can rebuild v0.3.61 and move latest, 0.3, or 0
• final PR contains no recovery or temporary validation workflow

Make shutdown cancellation effective

• combine every admitted backup/restore operation with the service shutdown context
• keep caller cancellation semantics while allowing Stop() to cancel synchronous backup, synchronous restore, scheduled/async work, and local download streams
• close blocked local download pipes on cancellation so a non-reading client cannot hold the operation open
• wait for the cancellation cleanup callback before releasing the operation WaitGroup entry
• make pg_dump process cleanup concurrency-safe and idempotent
• preserve cancellation in the psql error chain
• persist terminal backup state with a bounded cleanup context after operation cancellation

Verify release contents and provenance

• add a read-only release-integrity workflow triggered only by published releases
• download the complete expected asset set and validate checksums.txt
• safely extract every archive and verify binary version, target platform, VCS revision, and embedded commit
• execute the native Linux amd64 binary's version command
• inspect GHCR manifests and require linux/amd64 plus linux/arm64
• require immutable, latest, major/minor, and major tags to resolve to the same manifest digest
• verify each platform image's OCI version and revision labels
• include a stable-release monotonicity guard and regression-test rejection of v0.3.6 when v0.3.61 is latest

Validation

Candidate workflow 31068417050 passed on the exact final source patch before cleanup:

• service and repository unit tests
• service and repository race detector
• release verifier syntax
• stable release rollback guard, including negative test
• full content-level verification of the published v0.3.61 assets
• binary version/commit/platform checks
• GHCR floating-tag digest, platform, and OCI label checks
• deterministic final-state codebase inventory

Temporary patch scripts and validation workflow were deleted after the successful run.

[github-actions]

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA).

To sign, please reply with the following comment:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once — it will be valid for all your future contributions to this project.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}