fix(playbooks): don't let the preserve step depend on its own guard

/etc/restic is 0700 root, so before elway 754db4b this step's creates: guard
evaluated unprivileged, always reported the file absent, and the step re-ran
on every invocation. A plain cp -p would then have overwritten the preserved
ORIGINAL with the current post-repair file -- destroying the one thing the
step exists to keep.

Verified it never fired: the preserved copy still holds the original
(md5 7b42324c, mtime 2026-04-21) and differs from the live hook (c79bef9a,
2026-09-15). The guard is fixed now, but a destructive step should not depend
on its guard being right.

playbooks/ana-docker-backup-repair.yaml

@@ -1,7 +1,13 @@
 steps:
   - name: Preserve the previous hook
     sudo: true
-    shell: cp -p /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
+    # ⚠ -n as well as -p. /etc/restic is 0700 root, so before elway 754db4b
+    # the `creates:` guard evaluated unprivileged, always said "absent", and
+    # this step re-ran on every invocation — a plain `cp -p` would then have
+    # overwritten the preserved ORIGINAL with the current post-repair file,
+    # destroying the one thing the step exists to keep. The guard is fixed,
+    # but a destructive step should not depend on its guard being right.
+    shell: cp -np /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
     creates: /etc/restic/pre-backup.sh.before-repair-20260910
   - name: Install corrected canonical hook
     sudo: true