Keep leases alive during long restores and exports; PR review fixes

Full restore, raw directory restore, per-user export and the safety export
held a fixed-TTL lease on the location that nothing refreshed. A restore or
export running longer than that TTL let a cleanup take over and delete data
still in use. They now refresh the lease while they work (per blob, per row
batch, per written chunk), throttled to once a minute.

Also:
- backup:prune still applies snapshot retention when user-export retention
  fails for a location.
- The recovery kit carries the deletion delay, so a disaster recovery keeps
  the original protection instead of falling back to 7 days. Older kits
  still import with the default.
- CI checkouts no longer persist the token in the git config.
- recoveryKit() has its real return type; the stale baseline entry is gone.

lib/Service/UserRestoreService.php

@@ -45,7 +45,7 @@ final class UserRestoreService {
 	/** @throws UserMigrationException when user_migration is not enabled, or the restore itself fails */
 	public function restoreUser(Target $target, string $manifestPath, string $mode = self::MODE_REPLACE): IUser {
 		$service = $this->locator->get();
-		return $this->withSharedLock($target, function () use ($target, $manifestPath, $mode, $service): IUser {
+		return $this->withSharedLock($target, function (callable $refresh) use ($target, $manifestPath, $mode, $service): IUser {
 			$repo = $this->targets->repository($target);
 			// Only ever read a manifest the verified catalog actually recorded: a path alone
 			// (even one this app generated before) proves nothing about it still being current
@@ -80,7 +80,7 @@ final class UserRestoreService {
 			if ($existing !== null) {
 				// Never import over a live account: export its current state first, so nothing
 				// is lost if the restore turns out to be the wrong choice.
-				$safety = new RepositoryExportDestination($repo, $originalUid);
+				$safety = new RepositoryExportDestination($repo, $originalUid, LeaseService::throttled($refresh));
 				$service->export($safety, $existing);
 				$safetyManifestPath = $safety->manifestPath();
 				// Same race as UserBackupService::backupUser(): reopen the repository inside the
@@ -119,8 +119,7 @@ final class UserRestoreService {
 
 	private function withSharedLock(Target $target, callable $fn): mixed {
 		try {
-			// See UserBackupService::withSharedLock(): UserMigrationService exposes no progress,
-			// so this lease cannot be refreshed mid-call.
+			// Refreshed while the safety export writes data (see UserBackupService::withSharedLock()).
 			return $this->leases->with(PruneService::lockKey($target), LeaseService::SHARED, 3600, $fn);
 		} catch (LockedException) {
 			throw new \RuntimeException('A cleanup of ' . $target->getName() . ' is in progress; try again later');