fix(restore): reject multiple backup arguments in ods-restore.sh

[vaibhavsrv]

Why this matters

In ods/ods-restore.sh, argument parsing assigns positional parameters directly to backup_id="$1" without checking if a backup identifier was already parsed. If an operator or automated runner mistakenly passes multiple positional identifiers (e.g. ods-restore.sh snapshot-A snapshot-B), the first identifier is silently discarded and replaced by the subsequent one. This can cause restore operations to execute against the wrong backup target without user awareness.

This patch adds an explicit guard in the positional argument handler: if $backup_id is already populated, it logs Multiple backup IDs specified: '$backup_id' and '$1' and exits with error code 1. Existing options, dry-run flags, and single-argument restore workflows remain unchanged.

Validation

• Baseline: Invoking bash ods-restore.sh backup-1 backup-2 --dry-run silently discarded backup-1 and evaluated only backup-2.
• Post-fix: Exits with code 1 and writes Multiple backup IDs specified to standard output/error; valid single backup targets continue to process correctly.
• Restore argument validation suites: 2 passed. New-test Ruff, ShellCheck, and diff checks pass; new regressions wired into Linux CI.

Overlap check

• fix(backup): validate argument counts for options in ods-backup.sh #6325 (fix(backup): validate argument counts for options in ods-backup.sh) — companion argument boundary fix on backup script; cleanly composed at HEAD.
• fix(hermes): write SOUL.md atomically and guard missing template in build-installation-context.py #6324 (fix(hermes): write SOUL.md atomically and guard missing template in build-installation-context.py) — Hermes persona generation; distinct subsystem.
• fix(restore): resolve helper libraries from script dir when ODS_DIR lib is missing #6081 (fix(restore): resolve helper libraries from script dir when ODS_DIR lib is missing) — helper library resolution during restore, complementary.

Risk / AI disclosure

AI-assisted investigation, implementation and CLI regressions. This strengthens a CLI input boundary check, not runtime admission. Independent human review and platform/runtime qualification remain gates. No running configuration, deployment or upstream merge changed.

Follow-up integration evidence

Composed with #6325 at 5662f0d without conflicts. Production and test diffs passed together; backup and restore workflows remain intact.
Backlog composition was local-only (production/test diffs, excluding workflow/Makefile wiring); it is not an upstream merge or independent human approval. Declared live-review gates remain open.

[Lightheartdevs]

Thanks for this contribution. public-beta was promoted into main on 2026-09-24 and no longer receives changes, so we're closing pull requests that target it. This isn't a judgment on the change itself. If it's still needed, please rebase onto main and open a focused PR. See #7253 for details and the contribution policy.