Phase 2: verify per-user exports, refuse SMB without the native extension, matrix user CI

backup:verify accepts a user export path (users/<uid>/<export>): every blob its manifest references
is checked the same way as for a snapshot, shallow or --deep.

The SMB backend is refused at backup:target:add when the native smbclient PECL extension is not
loaded, instead of registering and then failing the first backup with "Seek failed": with only the
smbclient binary files_external falls back to a shell stream that cannot seek.

The per-user integration job now runs on Nextcloud 32-35, not just 35: it calls user_migration's
internal UserMigrationService, whose API may change between versions.

lib/Command/Verify.php

@@ -49,13 +49,17 @@ HELP);
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		try {
 			$target = $this->targets->get($input->getArgument('target'));
-			$result = $this->verify->verify($target, (string)$input->getArgument('snapshot'), (bool)$input->getOption('deep'));
+			$ref = (string)$input->getArgument('snapshot');
+			$deep = (bool)$input->getOption('deep');
+			$result = str_starts_with($ref, 'users/')
+				? $this->verify->verifyUserExport($target, $ref, $deep)
+				: $this->verify->verify($target, $ref, $deep);
 		} catch (\Throwable $e) {
 			$output->writeln('<error>' . $e->getMessage() . '</error>');
 			return 1;
 		}
 		$output->writeln(sprintf('%d files, %d blobs checked%s.', $result['filesChecked'], $result['blobsChecked'],
-			$input->getOption('deep') ? sprintf(' (%.1f MiB decrypted)', $result['bytesChecked'] / 1048576) : ''));
+			$deep ? sprintf(' (%.1f MiB decrypted)', $result['bytesChecked'] / 1048576) : ''));
 		if ($result['missing'] !== []) {
 			$output->writeln('<error>' . count($result['missing']) . ' blob(s) missing from the index:</error> ' . implode(', ', $result['missing']));
 		}