[Baylem]

Backup preparation could disable saving while a worker was still waiting for storage or repository access, and a stalled CSI capture could hold quiesce indefinitely. This prepares and verifies the real worker before save-off, then applies persisted deadlines to preparation, live copying and CSI capture.

• Restic workers mount the source, initialize/check the repository and become Ready before quiesce. An owned projected ConfigMap authorizes only the exact Backup, worker Pod, source identity and expiry. Workers use resource defaults and prefer the source node, with an optional hard placement requirement. First binding waits for an initial source Pod to be created and scheduled within the preparation deadline; a replacement after binding still fails closed. They receive no Kubernetes API token.
• Preparation, quiesce and CSI deadlines survive restarts and configuration changes. Copy failure/deletion revokes authorization and waits for actual worker drainage before save-on. Raw and already-stopped copies retain the full Job budget.
• Aborted CSI snapshots remain invalid even if the driver later reports readiness. Cleanup verifies snapshot/content UIDs and respects Retain policy. Restore and new snapshot-backed PVCs reject incomplete, aborted or replaced captures.
• Prepared workers record volume coverage before copy authorization and use the effective template under lifecycle ownership, including when a newer catalog revision is pending.

Includes controller, worker-script and snapshot regressions plus a dedicated two-node RWO preparation/restore CI drill. The Kind fixture does not claim qualification of attachable CSI drivers. Worker expiry assumes synchronized clocks; restoring saving after an operator outage still requires operator/agent recovery.

Dependencies included: #760 lifecycle exclusion, #766 stopped-server preparation, #767 capture metadata, #769 staged templates and its security/resource dependencies, #756 snapshot authorization, and #759 shared web build prerequisite. Review the commits for this issue group after those prerequisites. Shared restore cleanup retains ownership until failed startup drains, including force-deletion recovery. The preparation, placement and Restricted workload buckets remain registered in upstream change-based test selection.

Validation: production and regression-source compilation passed; required actionlint/offline zizmor and whitespace checks passed. Runtime unit, envtest and E2E execution remains in CI under the repository's compile-only local policy.

Closes #717.
Closes #719.