fix(regression): bad-restore uses custom-html-bkp-bad + ops.py+test_restore.py

backup-bot-two ignores backupbot.backup.path labels and always backs up
the full volume, making path-based restore-RED infeasible.

New approach: custom-html-bkp-bad has no pre_backup → marker never seeded
→ backup snapshot has no ci-marker.txt. pre_restore writes 'mutated'.
After restore: marker is MISSING or 'mutated' → test_restore_returns_state FAILS.
upgrade=skip (no version tags) is acceptable since passing_tiers_before=[install,backup].

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/regression/test_canaries.py

@@ -141,14 +141,15 @@ _BAD_BACKUP = {
 
 _BAD_RESTORE = {
     "id": "bad-restore",
-    "recipe": "custom-html",
-    "src": "recipe-maintainers/custom-html",
-    # Pin: regression-bad-restore @ 2026-06-02 — backup captures /usr/share/nginx/html/.backup-data/
-    # (a subdir NOT containing ci-marker.txt). Restore restores the subdir → marker stays "mutated"
-    # → test_restore_returns_state FAILS → restore tier RED. install+upgrade+backup PASS.
-    "ref": "7e03499ff17b343b622b510efcfc44add9651065",
+    "recipe": "custom-html-bkp-bad",
+    "src": "recipe-maintainers/custom-html-bkp-bad",
+    # Pin: custom-html-bkp-bad main @ 2026-06-02 (b6fe99de).
+    # No pre_backup hook → marker never seeded before backup → snapshot has no ci-marker.txt.
+    # pre_restore writes "mutated". After restore, marker is MISSING or "mutated" → FAIL → restore=RED.
+    # install+backup PASS; upgrade=skip (no version tags yet).
+    "ref": "b6fe99de41601f9e51bc7ea5b6072f0c3f56cdc3",
     "expected_green": False,
-    "stages": "install,upgrade,backup,restore,custom",
+    "stages": "install,backup,restore,custom",
     "failing_tier": "restore",
     "passing_tiers_before": ["install", "backup"],
     "stage_pass_checks": [],