Restore into a throwaway container (bur restore --drill)

bur restore APP --drill: the first real restore path, and the automated restorability check (which is not a correctness check).

• Pull the latest local backup, decrypt it, spin up a throwaway postgres:<major> of the matching major, apply globals, pg_restore the dump, assert restorability, then tear down (always, even on failure).
• Restorability means: the full decrypt succeeds, the full pg_restore exits 0, the --single-transaction commits, and the expected tables exist with non-zero rows. It does not claim a byte-for-byte match against the live DB, which legitimately differs by the time the drill runs.
• Spin the throwaway container with a non-postgres superuser name, so a missing-globals regression fails the drill instead of being masked.

Acceptance

• bur restore giftring --drill restores globals then the dump into a fresh container and commits.
• it asserts the expected tables exist with non-zero rows, and always removes the throwaway container.
• an integration test (tests/integration/test_roundtrip.py) runs the full backup and restore round-trip.