[Restore] gobackup-restore runner image (PostgreSQL + S3)

Part of #81.

Summary

gobackup's CLI is backup-only, so restore must be implemented from scratch. This issue delivers a standalone gobackup-restore container image that performs a full restore of a PostgreSQL backup stored in S3 — independently of the operator. It is the foundation the Restore CRD and integrity verification build on.

Scope

• New container image gobackup-restore (own Dockerfile under build/), bundling the postgresql-client (pg_restore/psql).
• Entrypoint reads the same gobackup.yml Secret shape the backup path already produces, plus restore parameters (source selection, target DB, overwrite flag) via env/flags.
• Pipeline: resolve artifact in S3 → download → decrypt → decompress → pg_restore/psql into the target DB.
• Reuse gobackup's storage, compressor, encryptor Go packages for the download/decrypt/decompress half; only the DB-load step is new.
• Artifact selection: latest / specific timestamp / explicit filename.
• Safe by default: refuse to overwrite a non-empty target unless overwrite is set.

Out of scope (tracked separately)

• Restore CRD / controller → separate issue.
• Engines other than PostgreSQL, backends other than S3 → support-matrix issue.
• Integrity verification → verification issue.

Acceptance criteria

• docker run gobackup-restore … restores a Postgres DB from an S3-stored (optionally gzip + encrypted) gobackup artifact into a target Postgres, verified by querying the restored data.
• Runs against MinIO + Postgres in CI/e2e with no operator present.
• Fails fast with a clear error on: missing artifact, decryption failure, checksum mismatch, non-empty target without overwrite.

Start with the existing gobackup storage, compressor, and encryptor packages and the backup Secret shape referenced in the issue. Then inspect build/ and the backup path to define the standalone image and entrypoint, with MinIO + Postgres CI/e2e as the first validation target. Done means the image restores supported artifacts and fails clearly for each listed error condition.