Keep leases alive during long restores and exports; PR review fixes

Full restore, raw directory restore, per-user export and the safety export
held a fixed-TTL lease on the location that nothing refreshed. A restore or
export running longer than that TTL let a cleanup take over and delete data
still in use. They now refresh the lease while they work (per blob, per row
batch, per written chunk), throttled to once a minute.

Also:
- backup:prune still applies snapshot retention when user-export retention
  fails for a location.
- The recovery kit carries the deletion delay, so a disaster recovery keeps
  the original protection instead of falling back to 7 days. Older kits
  still import with the default.
- CI checkouts no longer persist the token in the git config.
- recoveryKit() has its real return type; the stale baseline entry is gone.

lib/Command/Prune.php

@@ -43,9 +43,10 @@ final class Prune extends Command {
 			try {
 				$ru = $this->prune->applyUserExports($t, $dry);
 			} catch (\Throwable $e) {
+				// Snapshot retention is independent of this: report and carry on with it.
 				$output->writeln('<error>' . $t->getName() . ' (user exports): ' . $e->getMessage() . '</error>');
 				$rc = 1;
-				continue;
+				$ru = ['forgotten' => []];
 			}
 			if ($ru['forgotten'] !== []) {
 				$affected = count(array_unique(array_map(static fn (string $path): string => explode('/', $path)[1] ?? '', $ru['forgotten'])));