Final whole-branch review (opus) fixes:
- docker-publish.yml: upload-sarif was if:always() but not continue-on-error, so a
Trivy SARIF-emit flake would fail the job and SKIP the multi-arch publish. Made it
non-blocking so a scanner hiccup never blocks a release.
- deployment.md: seed-admin-rotated.txt is root-owned (written via docker exec, which
bypasses the gosu drop) — reverted an over-correction. Corrected the canonical
runtime-stage build description (no toolchain; non-root gosu). First-boot chown note.
- restore.sh: comment ownership root -> uid 1000.
Finding 1: no-arg branch used 'ls ... | while' which, under set -euo
pipefail, exits 1 on an empty backups dir (glob matches nothing). Replace
with shopt nullglob array check that prints a clear message and exit 0.
Finding 2: pass $TS and $SNAP_NAME as positional args to the inner alpine
shell instead of interpolating them into the sh -c string, making the swap
injection-proof. Behavior unchanged: pre-restore copy -> clear WAL/SHM -> install.
Jannis Braun