agent: secrets fail-loud on corrupt blob + small polish

Save and SaveAdmin now propagate loadBundle errors instead of silently
overwriting a corrupt file (data-loss fix). Tests added for both paths.
reportStats logs a Debug on RunStats failure; r in runJob gets a comment
explaining the prune-runner asymmetry; runner_test comment tightened.

internal/agent/runner/runner.go

@@ -348,6 +348,8 @@ func (r *Runner) reportStats(ctx context.Context, env restic.Env, patch api.Repo
 			patch.RawSizeBytes = &raw
 			patch.UniqueFiles = &files
 			patch.SnapshotCount = &snaps
+		} else {
+			slog.Debug("runner: stats refresh failed (non-fatal)", "err", err)
 		}
 	}
 	envOut, err := api.Marshal(api.MsgRepoStats, "", patch)

internal/agent/runner/runner_test.go

@@ -207,7 +207,9 @@ esac
 	}
 
 	// Assert envelope ordering: job.started → repo.stats → job.finished.
-	// (No log.stream expected here because check exits immediately.)
+	// (No log.stream expected because the fake script produces no
+	// output before exit 1 — a real restic check would emit log lines
+	// before exiting non-zero.)
 	order := envelopeOrder(tx.envs)
 	wantTypes := []api.MessageType{api.MsgJobStarted, api.MsgRepoStats, api.MsgJobFinished}
 	positions := map[api.MessageType]int{}