Validate CLI restore overwrite permission before changing the database #1448

Problem

On dev at c8aedf9, utopia restore parses --force but only prints it in the plan. It runs pg_restore --clean --if-exists before rejecting a non-empty data directory, and the documented requirement for --force on a non-empty database is not enforced. A manifest declaring data that is missing from the archive is accepted with a warning. These failures can leave the database changed while the original files remain.

Proposed scope and dependency reuse

• Validate required archive components, target path types and overwrite permission before restoring. Require --force for a non-empty database or a data directory that will be replaced; --yes only skips confirmation.
• Use the same preflight for --dry-run. Database-only archives must leave data untouched.
• Prepare replacement data separately, retain the old directory throughout pg_restore, and attempt to restore it if installation fails. Keep the existing archive version, checksum and sealing-key policies.
• Reuse the workspace's sqlx and tokio for the read-only database preflight, tempfile for owned staging and replacement directories, and test-only utopia-store for the required database-test guard. These add CLI dependency edges without introducing new package versions.
• Run recording-command regressions and real PostgreSQL backup/restore tests through cargo test --workspace; provide matching PostgreSQL 16 clients in CI. Tests use only disposable databases on a dedicated test cluster.

This is an in-place restore, and database/filesystem restoration is not atomic. Runtime database failures can leave partial SQL changes; operators must stop writers, retain a pre-restore backup and follow the documented retry/recovery procedure.

Related: #1444 addresses the data-directory --force path. This issue also covers database overwrite protection, preflight ordering, dry-run consistency and preservation of original files on restore failure. The local implementation and regression evidence are ready for review; this issue records the dependency rationale before the PR is published.