agent: secrets fail-loud on corrupt blob + small polish

Save and SaveAdmin now propagate loadBundle errors instead of silently
overwriting a corrupt file (data-loss fix). Tests added for both paths.
reportStats logs a Debug on RunStats failure; r in runJob gets a comment
explaining the prune-runner asymmetry; runner_test comment tightened.

internal/agent/runner/runner_test.go

@@ -207,7 +207,9 @@ esac
 	}
 
 	// Assert envelope ordering: job.started → repo.stats → job.finished.
-	// (No log.stream expected here because check exits immediately.)
+	// (No log.stream expected because the fake script produces no
+	// output before exit 1 — a real restic check would emit log lines
+	// before exiting non-zero.)
 	order := envelopeOrder(tx.envs)
 	wantTypes := []api.MessageType{api.MsgJobStarted, api.MsgRepoStats, api.MsgJobFinished}
 	positions := map[api.MessageType]int{}