lab: host restore drill — prove sealed backup restores (M2 prereq)

The CLI test proves export→import logic against a fake gopass; this proves the
real recovery path end-to-end against real gopass in an isolated throwaway store:
seed → seal → destroy every entry → import → assert byte-equal restoration and no
plaintext in the bundle. It is the safety net for no-op-RevokeOld drivers (e.g.
appsecret), where the sealed .age backup is the only rollback — the prerequisite
for the first real rotation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lab/README.md

@@ -61,6 +61,11 @@ multipass exec incredigo-sbx -- bash -lc '
 
 ## Custody / smoke
 
+- `lab-restore-drill.sh` — proves the sealed `.age` backup is a **real recovery path** on
+  the host against real gopass (isolated throwaway store, fake creds): seed → seal →
+  destroy every entry → `import` → assert byte-equal restoration + no plaintext in the
+  bundle. The safety net for no-op-`RevokeOld` drivers (e.g. `appsecret`), where the
+  backup is the only rollback. Prerequisite for the first real rotation (ROADMAP M2).
 - `lab-store.sh` — throwaway key + gopass store + fake `.env`/`.aws`/consumer files.
 - `lab-run.sh` — scan→status→migrate→export→import→`rotate --dry-run --blast`→worklist.
 - `lab-harness.sh`, `incredigo-lab-setup.sh` — older combined harness variants.