Verify a backup without restoring it (bur verify)

bur verify [--only APP] [--date TS]: a real integrity check without a full restore.

Stream the whole artefact through age -d into pg_restore --list (discarding the output), checking both return codes. Because age MACs the entire ciphertext, a full decrypt fails on any truncation or corruption, which is the actual signal. It works on local and R2 copies.

The naive "validate the header then pg_restore --list" design is a false-confidence trap: pg_dump -Fc writes its table of contents near the front, so a header-only check passes on a truncated dump whose data is missing. Reading the full stream closes that gap.

Acceptance

• detects a corrupt archive, a bad age header, and a truncated but header-valid artefact (the case a header-only check misses).
• passes a good archive; runs against both local and R2 sources.
• documented as proving the backup decrypts cleanly and the archive parses, not that it loads into Postgres (that's the drill).