[br] BR selective table restore can publish a foreign-key child without its parent and silently accept orphan rows

## Bug Report

### 1. Minimal reproduce step (Required)

**Environment**

master 05b396fb6636; verified BR a942e4684f43

**Steps**

Create parent p and child c with an enforced FK, insert p(1) and c(1,1), and back up the database. Drop the database and run br restore table --db --table c against the backup. Verify that p is absent while c and its FK metadata are present, then insert c(2,999) with foreign_key_checks=ON.

### 2. What did you expect to see? (Required)

BR must either include the referenced parent table in the restore closure or reject the selective restore before publishing schema or data. A successful restore must not leave any restored FK row without its referenced parent.

### 3. What did you see instead? (Required)

Two independent restores reported Table Restore success, validated checksum, restored c(1,1) without p, and accepted c(2,999). Restoring the full database from the same backup restored p and caused the same invalid insert to fail with error 1452.

### 4. What is your TiDB version? (Required)

master 05b396fb6636; verified BR a942e4684f43

Likely root cause and fix direction

**Likely root cause**

filterRestoreFiles applies the user table filter without closing foreign-key dependencies. BRIECreateTables then disables ForeignKeyChecks for the internal batch because it assumes the batch is dependency-complete. The selected child TableInfo and KVs are published without the excluded parent, while checksum validates only the selected physical table.

**Fix direction**

Build an FK dependency graph before schema publication. For every enforced FK in the selected snapshot, either include the referenced table and report the expanded scope or fail with a clear dependency error. Keep the internal FK-check bypass only for a dependency-closed batch. Independently make runtime FK enforcement fail closed when referenced metadata is unavailable.

Reproduce the selective restore using the stated parent/child tables and verify the orphan insert with foreign_key_checks=ON. Trace filterRestoreFiles and BRIECreateTables to understand how the table filter, schema publication, and internal FK-check bypass interact. Done means the restore includes referenced parents or rejects the request before publishing, and unavailable referenced metadata cannot permit orphan rows.

Written by the indexing model from the issue text.