P3-03: restic restore + diff execution path

Wires JobRestore and JobDiff end-to-end at the agent layer (the wizard
backend that drives this lands in the next slice).

- internal/api: JobRestore + JobDiff JobKind constants. CommandRunPayload
  grows nullable Restore + Diff sub-payloads. RestorePayload carries
  snapshot_id, paths, in_place, target_dir; DiffPayload carries
  snapshot_a + snapshot_b.
- internal/restic.RunRestore wraps 'restic restore <sid> --target ...
  [--no-ownership] [--include p]...' with --json. New pumpRestoreStdout
  parses the per-line status / summary objects (drops raw status from
  log.stream — the throttled job.progress envelope covers it). New
  RestoreStatus + RestoreSummary types mirror restic's wire shape.
- internal/restic.RunDiff wraps 'restic diff --json <a> <b>'.
- internal/agent/runner: RunRestore translates RestoreStatus into
  job.progress (mapping FilesRestored → FilesDone etc) with a small
  estimateETA helper since restic doesn't provide ETA for restore.
  RunDiff is a thin streamHandler wrapper.
- cmd/agent dispatcher gains JobRestore + JobDiff cases. Both reuse
  the spawn() helper from P3-X1 so cancel just works.
- Drive-by fix: lastProgress was initialised to time.Now() so the
  very first status event was suppressed by the 1s throttle if the
  agent reported quickly. Initialise to time.Time{} (zero) so the
  first event always emits. Affects backup + restore.

Tests:
- restore_test covers restore happy path (started → progress →
  finished, kind=restore on the started envelope), in-place argv
  asserts no --no-ownership, new-dir argv asserts --no-ownership +
  --target + --include, diff produces the expected log.stream lines.

Restage block (CLAUDE.md) is deferred to the end of the restore
sub-phase so we restage once with all changes.

cmd/agent/main.go

@@ -612,6 +612,33 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 		spawn("unlock", func(jobCtx context.Context) error {
 			return r.RunUnlock(jobCtx, p.JobID)
 		})
+	case api.JobRestore:
+		if p.Restore == nil {
+			return fmt.Errorf("restore: command.run carried no restore payload")
+		}
+		rp := *p.Restore
+		if rp.SnapshotID == "" {
+			return fmt.Errorf("restore: snapshot_id is required")
+		}
+		if !rp.InPlace && rp.TargetDir == "" {
+			return fmt.Errorf("restore: target_dir required for non-in-place restore")
+		}
+		slog.Info("agent: accepting restore job",
+			"job_id", p.JobID, "snapshot_id", rp.SnapshotID,
+			"paths", rp.Paths, "in_place", rp.InPlace, "target", rp.TargetDir)
+		spawn("restore", func(jobCtx context.Context) error {
+			return r.RunRestore(jobCtx, p.JobID, rp.SnapshotID, rp.Paths, rp.InPlace, rp.TargetDir)
+		})
+	case api.JobDiff:
+		if p.Diff == nil || p.Diff.SnapshotA == "" || p.Diff.SnapshotB == "" {
+			return fmt.Errorf("diff: command.run carried incomplete diff payload")
+		}
+		dp := *p.Diff
+		slog.Info("agent: accepting diff job",
+			"job_id", p.JobID, "a", dp.SnapshotA, "b", dp.SnapshotB)
+		spawn("diff", func(jobCtx context.Context) error {
+			return r.RunDiff(jobCtx, p.JobID, dp.SnapshotA, dp.SnapshotB)
+		})
 	default:
 		return fmt.Errorf("kind %q not implemented yet (Phase 2 lands the rest)", p.Kind)
 	}