docs(recovery): align restore overlay with successor #212

[cursor]

Why this exists

PR #192 at eafbfa9 already records Draft #212 as the restore successor in docs/DOCUMENTATION_FITNESS.md and docs/TRACEABILITY.md. The product and technical contracts still present predecessor #209 as the active pg_restore path. That is a buyer-visible merge error: an operator following the PRD/TRD would treat an unsafe EOF-consumption check as the current restore contract.

This branch keeps the five-file canonical lane and aligns the remaining overlays.

Operator action

• Do not merge docs: rebuild canonical product and technical contracts #192 at eafbfa9.
• Do not merge feat(recovery): restore bounded PostgreSQL logical archives #209 at afbe449.
• Review this successor for the documentation overlay only.
• Keep feat(recovery): execute bounded logical PostgreSQL backups #208 and fix(recovery): accept custom-format restore seek positions #212 as the source writers for backup/restore execution.
• After this lands, continue Issue [Resilience/Acquisition] Establish tested PostgreSQL backup and PITR recovery contract #204 with a live isolated custom-format restore drill rather than another five-file rewrite.

What changed

• PRD restore capability now names Draft fix(recovery): accept custom-format restore seek positions #212 as the successor and freezes feat(recovery): restore bounded PostgreSQL logical archives #209.
• PRD FR-3 now states that a role with arbitrary SQL can call set_config; RLS does not prevent that.
• TRD restore paragraph matches the same overlay split, including metadata-fingerprint verification.
• FITNESS and TRACEABILITY register Draft fix(config): sync mandatory Fernet operator contract #210 as the Fernet operator-contract successor to fix(config): separate provisioning and require secret encryption #193.

No runtime source, schema, workflow, or package metadata changes.

Refs #192, #209, #212, #210, #204.