agent: secrets fail-loud on corrupt blob + small polish

Save and SaveAdmin now propagate loadBundle errors instead of silently
overwriting a corrupt file (data-loss fix). Tests added for both paths.
reportStats logs a Debug on RunStats failure; r in runJob gets a comment
explaining the prune-runner asymmetry; runner_test comment tightened.

internal/agent/runner/runner.go

@@ -348,6 +348,8 @@ func (r *Runner) reportStats(ctx context.Context, env restic.Env, patch api.Repo
 			patch.RawSizeBytes = &raw
 			patch.UniqueFiles = &files
 			patch.SnapshotCount = &snaps
+		} else {
+			slog.Debug("runner: stats refresh failed (non-fatal)", "err", err)
 		}
 	}
 	envOut, err := api.Marshal(api.MsgRepoStats, "", patch)