The backup health check previously accepted any non-empty .sql.gz file as
the latest backup, so an external producer (e.g. a cron pg_dump | gzip
wrapper that does not use the .partial staging convention) crashing
mid-write could leave a truncated archive that /api/health reported as
fresh. Now the newest candidate must decompress as a complete gzip stream
(a valid trailer is producer-agnostic proof of completion); verdicts are
cached by size+mtime so health polls stay cheap, corrupt archives are
skipped with a database_backup_corrupt warning, and the check falls back
to the newest complete backup.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
