Scheduled restore drill across both Postgres majors

The recurring disaster-recovery check, and the real test of whether a backup is restorable. It automates the local --drill across the whole set.

For every discovered database, pull its latest backup and restore --drill into a throwaway container of the matching major (postgres:15 or postgres:16). Apply globals first, then the dump, into a container whose superuser is not named postgres so a missing-globals regression fails the drill. Run the restorability check, then tear down. It runs on a weekly schedule and locally or in CI, away from production (pulling from R2), so the throwaway containers don't contend with the production VPS. A drill failure alerts via Discord.

bur backup exiting 0 only proves the files were written. Only this full restore with a row-count check proves they can be read back. A drill that never runs is how a dead backup gets discovered during a real recovery.

Acceptance

• iterates over every discovered database's latest backup and passes for both majors.
• runs away from production; a missing-globals regression fails the drill (non-postgres superuser).
• a drill failure notifies via Discord; documented as the recurring DR check that replaces a manual runbook step.