[Verify] Backup integrity verification (opt-in, per-Backup)

Part of #81. Depends on #92 (shares download/decrypt/decompress).

Summary

Optional per-Backup integrity check: after a successful backup run, re-download the artifact and confirm it decrypts, decompresses, and matches its checksum — catching silent corruption and truncated uploads.

Scope

• spec.verify.integrity (opt-in) on the Backup CRD.
• Post-run verification Job that reuses the runner's download/decrypt/decompress path (no DB needed) and validates checksum + successful decode.
• Surface the result as a status condition (BackupIntegrity) + a Prometheus metric.

Out of scope

• Actual restore into a DB (that is restore-mode / scheduled test-restore).

Acceptance criteria

• A corrupted/truncated artifact flips the BackupIntegrity condition to False and increments a failure metric.
• Healthy backups report the condition True; the feature is off by default.

Start with issue #92 and the runner's download/decrypt/decompress path, then trace how the Backup CRD exposes spec and status and how metrics are registered. Done means opt-in verification detects corrupted or truncated artifacts, reports the BackupIntegrity condition correctly, increments the failure metric, and leaves the feature disabled by default.