Workstation-side backup script: pull factory + drawings off the Pi

[bryanwintermute]

Background

Today there's no automated off-Pi backup of:

• factory.dsk — the operator-blessed curated baseline (~100MB, represents real curation effort)
• outside-world/Kid's Drawings/ — the kid's persistent saves

If the Pi's boot media dies (microSD wear, NVMe failure), all of this is lost. The repo itself preserves Ansible config + scripts + docs, but the captured runtime state is single-copy on the Pi.

Proposal

scripts/backup-to-workstation.sh that:

1. SSHes to the Pi, scp-pulls factory.dsk + tar-pulls outside-world/ (excluding USB-* auto-mount sub-folders) + optionally the most recent rotating snapshot
2. Saves to a configurable local path (default ~/chimebox-backups/<host>/<timestamp>/)
3. SHA-verifies after transfer
4. Optionally rotates old backups (keep last N)

Pull mode (workstation initiates) is cleaner than push mode: no Pi-side SSH key setup, no host-firewall concerns.

Acceptance

• ./scripts/backup-to-workstation.sh pulls the canonical files with SHA verification
• Documented in scripts/README.md and a section in docs/operations.md (maybe under suggested cadence)
• Doesn't disturb the kiosk (uses snapshot-tier copy, not in-place)

History

Discovered 2026-05-14 the night of public flip when we realized factory.dsk had no off-Pi copy after the curation work. Did an ad-hoc backup at ~/chimebox-backups/2026-05-14-pre-public-flip/ as the immediate mitigation.