feat(restic fv-ml1): Diariz in the host backup — run-before pg_dump (soft-fail), stage dir, model cache + raw pgdata excluded; first snapshot 776b700b

configs/restic/ana-ml2/diariz-dump.sh

@@ -0,0 +1,20 @@
+#!/bin/sh
+# run-before for fv-ml1's restic backup: a consistent pg_dump of the Diariz pilot's postgres (2026-10-19, Prime: "back it
+# up now"). The raw diariz_pgdata volume is excluded, because live PG files copied file by file are not a consistent copy.
+#
+# SOFT-FAIL BY DESIGN: this is the host's ONLY backup (bare metal), and a pilot app must never block it. On any failure
+# the previous dump is REMOVED, so a stale dump is never snapshotted as current. Then a warning, and exit 0 so the rest of
+# the host backup proceeds.
+set -u
+d=/var/lib/restic/stage/diariz; out=$d/diariz.pgdump
+install -d -m 0700 "$d"
+if docker inspect -f '{{.State.Running}}' diariz-postgres-1 2>/dev/null | grep -q true &&
+   docker exec diariz-postgres-1 pg_dump -U diariz -d diariz -Fc > "$out.tmp" 2>"$d/dump.err" &&
+   [ -s "$out.tmp" ]; then
+  mv -f "$out.tmp" "$out"; date -u +%FT%TZ > "$d/dumped-at"; rm -f "$d/dump.err"
+  echo "diariz-dump: ok, $(stat -c %s "$out") bytes"
+else
+  rm -f "$out" "$out.tmp" "$d/dumped-at"
+  echo "diariz-dump: WARNING - no dump this run (postgres down or pg_dump failed: $(head -c 300 "$d/dump.err" 2>/dev/null)); host backup continues" >&2
+fi
+exit 0