feat(tasktree): add GitHub disaster recovery backups

tools/src/tasktree-cli.test.ts

@@ -54,7 +54,18 @@ test("TaskTree command surface covers hierarchy, lifecycle, batch, stats, and re
       [["report", "get", "--report", "tr_1", "--overapi"], { operation: "report.get", reportId: "tr_1" }],
       [["report", "write", "--task", "tt_1", "--title", "Execution", "--stdin", "--overapi"], {
         operation: "report.write", taskId: "tt_1", title: "Execution", body: "# Result\n\nPassed.\n"
-      }, "# Result\n\nPassed.\n"]
+      }, "# Result\n\nPassed.\n"],
+      [["backup", "create", "--dry-run", "--reason", "smoke", "--overapi"], {
+        operation: "backup.create", dryRun: true, reason: "smoke"
+      }],
+      [["backup", "status", "--overapi"], { operation: "backup.status" }],
+      [["backup", "verify", "--overapi"], { operation: "backup.verify" }],
+      [["backup", "restore", "--overapi"], {
+        operation: "backup.restore", confirm: false
+      }],
+      [["backup", "restore", "--confirm", "--expected-sha", "a".repeat(64), "--overapi"], {
+        operation: "backup.restore", confirm: true, expectedSha256: "a".repeat(64)
+      }]
     ];
     for (const [argv, expected, stdin] of cases) {
       await runTaskTreeCli(argv, env, stdin);
@@ -83,6 +94,14 @@ test("TaskTree rejects ambiguous title input and empty update patches before tra
     runTaskTreeCli(["task", "update", "--task", "tt_1", "--overapi"], { HWLAB_TASKTREE_API_URL: "http://tasktree.test" }),
     (error: any) => error?.code === "update_patch_required"
   );
+  await assert.rejects(
+    runTaskTreeCli(["backup", "restore", "--confirm", "--overapi"], { HWLAB_TASKTREE_API_URL: "http://tasktree.test" }),
+    (error: any) => error?.code === "restore_confirmation_invalid"
+  );
+  await assert.rejects(
+    runTaskTreeCli(["backup", "restore", "--expected-sha", "a".repeat(64), "--overapi"], { HWLAB_TASKTREE_API_URL: "http://tasktree.test" }),
+    (error: any) => error?.code === "restore_confirmation_invalid"
+  );
 });
 
 test("TaskTree rejects unknown, duplicate, hidden, and extra CLI arguments", async () => {