Close release and quarantine recovery gaps

[Ghost-Frame]

Summary

• preserve the legacy backup v1 wire contract when quarantine is disabled
• add a separate quarantine artifact and v2 manifest for filesystem quarantine recovery sets
• fail closed for unsupported R2 backup configurations and test the restricted receiver
• expose the optional canonical quarantine path through the hardened systemd units
• bump the paired CLI and MCP packages to 0.10.1 for an immutable current release

Verification

• cargo fmt --all -- --check
• bash deploy/tests/backup_scripts_test.sh
• cargo test --locked --package frameshift-cli --package frameshift-mcp
• cargo clippy --locked --package frameshift-cli --package frameshift-mcp --all-targets -- -D warnings
• git diff --check
• signed commit verification