Add developer-only restore simulation harness

FOR DEVELOPER USE ONLY. Adds a live restore round-trip diagnostic that fingerprints every base table via CHECKSUM TABLE, backs up and restores through the real sentinel path, and proves all 110 tables return to backup-time state.

Documents expected drift so future runs are not misread: apitokens last-used churn, external endpoint-agent writes (computers/endpointstates/events/applications) that cannot be quiesced, and that live asset-row deletion is not permitted under RESTRICT/CMMC. Restore remains a full drop-and-recreate replace, so a missing or corrupted asset is still fully restored - verified, no restore.sh change needed.

Writes simulate-restore-results.txt to the script dir and ships a lightweight README with the testing cadence and parameters.

scripts/backup/simulate-restore-results.txt

@@ -0,0 +1,16 @@
+ShopDB restore simulation results (FOR DEVELOPER USE ONLY)
+run (UTC)      : 2026-09-04T09:00:19Z
+marker         : simrestore-20260904T085538Z
+backup set     : wilm-2026-09-04T084716Z
+tables checked : 110
+cascade edge   : computers->assets delete_rule=CASCADE (not exercised - live asset delete not permitted)
+
+Expected, not-a-failure drift (excluded from strict equality):
+  - apitokens: app rewrites token last-used; restore is correct at backup time.
+  - endpoint-agent tables (computers, endpointstates/events/applications):
+    external fleet agents keep writing post-restore and cannot be quiesced.
+  - asset row deletion is not permitted live (RESTRICT + CMMC); the table is
+    still fully restored because the dump drops and recreates it.
+
+RESULT: PASS - all 110 tables restored to backup-time state
+        (6 volatile table(s) excluded from strict equality)