lab: host restore drill — prove sealed backup restores (M2 prereq)

The CLI test proves export→import logic against a fake gopass; this proves the
real recovery path end-to-end against real gopass in an isolated throwaway store:
seed → seal → destroy every entry → import → assert byte-equal restoration and no
plaintext in the bundle. It is the safety net for no-op-RevokeOld drivers (e.g.
appsecret), where the sealed .age backup is the only rollback — the prerequisite
for the first real rotation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -86,9 +86,11 @@ credential, verified backup + restore-drill first, verify-new-before-revoke-old.
   6. **aws** — last: real IAM user with minimal policy, console as recovery path.
 - [ ] Each rung: runbook entry (local ROTATION-REAL-CRED-RUNBOOK.md), audit log
       retained, proofs.go + ROTATION-PROOFS.md updated in the same commit.
-- [ ] Backup restore drill: before the first real rotation, prove
+- [x] Backup restore drill: before the first real rotation, prove
       `import` of a sealed backup actually restores the store (not just that the
-      bundle verifies).
+      bundle verifies). Done two ways: `TestExportImportRoundTripCLI` (fake gopass,
+      in CI) + `lab/lab-restore-drill.sh` (real gopass on the host, isolated store —
+      seed → seal → destroy → restore → assert byte-equal, no plaintext leak).
 
 Exit criteria: ≥5 drivers at LIVE-REAL, zero incidents, execute-gate enforces
 proof levels.