backup: harden lifecycle fencing and skip near-empty archives

backup-node.sh now stops services, fences COMPOSE_FILE during backup, and
restores via EXIT trap; consumers skip <1MB .tar.zst artifacts so purged-
volume junk cannot shadow real backups.

Co-authored-by: Cursor <cursoragent@cursor.com>

restore-volumes.sh

@@ -135,9 +135,9 @@ while IFS= read -r key; do
     declare newest_file
 
     if [[ -n "$remote_source" ]]; then
-	newest_file=$($dir/list-backups.sh "$remote_source" | grep "rpc_$key-20" | sort | tail -n 1)
+	newest_file=$($dir/list-backups.sh "$remote_source" | select_newest_remote_backup_from_list "$remote_source" "rpc_$key")
     else
-	newest_file=$(ls -1 "$backup_dir"/"rpc_$key"-[0-9]*G.tar.zst 2>/dev/null | sort | tail -n 1)
+	newest_file=$(select_newest_local_backup "$backup_dir" "rpc_$key")
     fi
 
     if [ -z "$newest_file" ]; then