P3-03: restic restore + diff execution path

Wires JobRestore and JobDiff end-to-end at the agent layer (the wizard
backend that drives this lands in the next slice).

- internal/api: JobRestore + JobDiff JobKind constants. CommandRunPayload
  grows nullable Restore + Diff sub-payloads. RestorePayload carries
  snapshot_id, paths, in_place, target_dir; DiffPayload carries
  snapshot_a + snapshot_b.
- internal/restic.RunRestore wraps 'restic restore <sid> --target ...
  [--no-ownership] [--include p]...' with --json. New pumpRestoreStdout
  parses the per-line status / summary objects (drops raw status from
  log.stream — the throttled job.progress envelope covers it). New
  RestoreStatus + RestoreSummary types mirror restic's wire shape.
- internal/restic.RunDiff wraps 'restic diff --json <a> <b>'.
- internal/agent/runner: RunRestore translates RestoreStatus into
  job.progress (mapping FilesRestored → FilesDone etc) with a small
  estimateETA helper since restic doesn't provide ETA for restore.
  RunDiff is a thin streamHandler wrapper.
- cmd/agent dispatcher gains JobRestore + JobDiff cases. Both reuse
  the spawn() helper from P3-X1 so cancel just works.
- Drive-by fix: lastProgress was initialised to time.Now() so the
  very first status event was suppressed by the 1s throttle if the
  agent reported quickly. Initialise to time.Time{} (zero) so the
  first event always emits. Affects backup + restore.

Tests:
- restore_test covers restore happy path (started → progress →
  finished, kind=restore on the started envelope), in-place argv
  asserts no --no-ownership, new-dir argv asserts --no-ownership +
  --target + --include, diff produces the expected log.stream lines.

Restage block (CLAUDE.md) is deferred to the end of the restore
sub-phase so we restage once with all changes.

internal/api/messages.go

@@ -52,14 +52,17 @@ type JobKind string
 
 // Allowed JobKind values. backup is operator/cron driven; init runs
 // once per host on first connect; forget/prune/check fire from the
-// server-side maintenance ticker; unlock is operator-only.
+// server-side maintenance ticker; unlock and restore are operator-
+// only; diff is operator-only and read-only.
 const (
-	JobBackup JobKind = "backup"
-	JobInit   JobKind = "init"
-	JobForget JobKind = "forget"
-	JobPrune  JobKind = "prune"
-	JobCheck  JobKind = "check"
-	JobUnlock JobKind = "unlock"
+	JobBackup  JobKind = "backup"
+	JobInit    JobKind = "init"
+	JobForget  JobKind = "forget"
+	JobPrune   JobKind = "prune"
+	JobCheck   JobKind = "check"
+	JobUnlock  JobKind = "unlock"
+	JobRestore JobKind = "restore"
+	JobDiff    JobKind = "diff"
 )
 
 // JobStatus is the lifecycle state of a job.
@@ -143,6 +146,35 @@ type CommandRunPayload struct {
 	// just executes whatever is here.
 	PreHook  string `json:"pre_hook,omitempty"`
 	PostHook string `json:"post_hook,omitempty"`
+
+	// Restore is populated only for kind=restore. See RestorePayload
+	// for the shape; nil for every other kind.
+	Restore *RestorePayload `json:"restore,omitempty"`
+
+	// Diff is populated only for kind=diff. See DiffPayload for
+	// shape; nil for every other kind.
+	Diff *DiffPayload `json:"diff,omitempty"`
+}
+
+// RestorePayload carries restore-specific arguments on a JobRestore
+// command.run. Paths are absolute paths inside the snapshot (same
+// shape restic accepts as positional args). When InPlace is true the
+// agent restores at root (`--target /`) and preserves uid/gid/mode;
+// otherwise it restores into TargetDir with --no-ownership so the
+// operator can inspect the files as the agent user.
+type RestorePayload struct {
+	SnapshotID string   `json:"snapshot_id"`
+	Paths      []string `json:"paths"`
+	InPlace    bool     `json:"in_place"`
+	TargetDir  string   `json:"target_dir,omitempty"` // ignored when in_place=true
+}
+
+// DiffPayload carries snapshot-diff arguments on a JobDiff command.run.
+// SnapshotA / SnapshotB may be either short or long IDs; restic
+// accepts both.
+type DiffPayload struct {
+	SnapshotA string `json:"snapshot_a"`
+	SnapshotB string `json:"snapshot_b"`
 }
 
 // CommandCancelPayload is the server → agent cancel signal.