M5: upgrade + backup/restore stages green (custom-html); backup-bot-two oneshot

3-stage run green (install/upgrade/backup), clean teardown. backupbot deployed
via reconcile oneshot; PTY (script) for abra backup/restore; -m for secret generate
(no value leak). M5 CLAIMED.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/custom-html/test_backup.py

@@ -0,0 +1,28 @@
+"""custom-html — backup/restore stage (D2): backup, mutate state, restore, assert the restored
+state matches the pre-mutation (backed-up) state."""
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
+from harness import lifecycle  # noqa: E402
+
+MARKER_PATH = "/usr/share/nginx/html/ci-marker.txt"
+
+
+def test_backup_mutate_restore(deployed):
+    domain = deployed
+
+    # 1) establish original state, then back it up
+    lifecycle.exec_in_app(domain, ["sh", "-c", f"echo original > {MARKER_PATH}"])
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original"
+    lifecycle.backup_app(domain)
+
+    # 2) mutate state (diverge from the backup)
+    lifecycle.exec_in_app(domain, ["sh", "-c", f"echo mutated > {MARKER_PATH}"])
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "mutated"
+
+    # 3) restore -> state returns to the backed-up "original"
+    lifecycle.restore_app(domain)
+    lifecycle.wait_healthy(domain)
+    assert lifecycle.http_body(domain, "/ci-marker.txt").strip() == "original", \
+        "restore did not return the pre-mutation state"