fix(release): make deployment backup and rollback immutable

scripts/verify_release_backup.sh

@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 CONTAINER="geointel"
 BACKUP_DIR=""
 
@@ -59,15 +60,22 @@ required = {
     "database_name",
     "database_user",
     "image_id",
-    "git_commit",
 }
 missing = sorted(required - payload.keys())
 if missing:
     raise SystemExit(f"Backup manifest misses: {', '.join(missing)}")
 if payload["schema_version"] != 1 or payload["read_only_source"] is not True:
     raise SystemExit("Unsupported or unsafe backup manifest")
+tool_revision = payload.get("backup_tool_revision", payload.get("git_commit"))
+if not isinstance(tool_revision, str) or len(tool_revision) < 7:
+    raise SystemExit("Backup manifest lacks its backup-tool revision")
+running_revision = payload.get("running_image_revision")
+if running_revision is not None and not isinstance(running_revision, str):
+    raise SystemExit("Backup manifest has an invalid running-image revision")
 PY
 
+python3 "$ROOT/scripts/release_backup_snapshot.py" verify-backup --backup-dir "$BACKUP_DIR"
+
 if [ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null || true)" != "true" ]; then
   echo "Container '$CONTAINER' is required to run pg_restore --list." >&2
   exit 3