backup: harden lifecycle fencing and skip near-empty archives

backup-node.sh now stops services, fences COMPOSE_FILE during backup, and
restores via EXIT trap; consumers skip <1MB .tar.zst artifacts so purged-
volume junk cannot shadow real backups.

Co-authored-by: Cursor <cursoragent@cursor.com>

cleanup-backups.sh

@@ -14,6 +14,8 @@
 set -euo pipefail
 
 BASEPATH="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=volume-utils.sh
+source "$BASEPATH/volume-utils.sh"
 BACKUP_DIR="${BACKUP_DIR:-/backup}"
 TRASH_DIR="${TRASH_DIR:-$BACKUP_DIR/trash}"
 KEEP_COUNT="${KEEP_COUNT:-3}"
@@ -163,6 +165,20 @@ cleanup_volume_backups() {
             continue
         fi
 
+        if ! is_restorable_backup_archive "$file"; then
+            local near_size
+            near_size=$(backup_archive_size_bytes "$file")
+            local near_meta
+            near_meta=$(metadata_for_archive "$file")
+            add_trashed_bytes "$file"
+            trash_file "$file" "near-empty artifact (${near_size} bytes, excluded from KEEP_COUNT)"
+            if [[ -f "$near_meta" ]]; then
+                add_trashed_bytes "$near_meta"
+                trash_file "$near_meta" "metadata for near-empty artifact"
+            fi
+            continue
+        fi
+
         volume_files["$volume_key"]+="$file"$'\n'
     done < <(find "$BACKUP_DIR" -maxdepth 1 -type f -name 'rpc_*-*.tar.zst' -print0 2>/dev/null)