Add S4 recovery checkpoints and isolated restore

[acburdine]

Implement S4 of the Ghost CLI replacement plan: recovery checkpoints containing the selected databases, content, configuration and exact image identities, with a tested restore path to a fresh destination.

The TypeScript manager runs directly on the pinned Node 22 image using native type stripping, with no compilation step or npm runtime dependencies. It performs backup/restore behind a shared site lock and durable journal. Backups stop application writers and ingress, verify the checkpoint, then restore the previous service state. Restores verify database row counts, files and Ghost readiness in isolation; an explicit activation step enables normal traffic. Interrupted operations can be recovered without stealing a live manager's lock or replaying a checkpoint after activation has begun.

• Add oxfmt using Ghost's formatting conventions, Oxlint correctness/braces checks, and strict tsc --noEmit checks in CI. Format the JavaScript/TypeScript baseline and give journal/checkpoint/Docker/subprocess data explicit types.
• Add the host dispatcher, manager image and release publishing workflow, checkpoint retention, space checks, and recovery documentation.
• Apply the shared lock to install, configuration and Caddy mutations; surface unresolved operations in the site checker.
• Fix configuration validation to compare decoded JSON values, preserving literal dollars, backslashes, tabs and multiline settings.

Initial support covers local/production Ghost with stack-managed MySQL and optional ActivityPub. Analytics, external databases, Compose overrides and rootless/userns recovery are refused pending explicit support. Caddy certificates/cache are regenerated; remote side effects are outside the checkpoint's scope. See docs/recovery.md for the full contract.

Validation:

• 249 helper/matrix tests passed.
• npm ci --ignore-scripts, npm run format:check, npm run lint, and npm run typecheck passed.
• Real local, HTTPS production and ActivityPub restore drills passed against the TypeScript manager image, including dispatcher/manager termination, lock exclusion, interrupted restore recovery, database/theme/assets/configuration checks and activation.
• Minimum-host-prerequisite installation and local ShellCheck 0.11.0 passed. The pinned ShellCheck 0.10.0 check remains for CI.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}