Manifest schema + validator: plural `backup` participations and per-database hook warning

[pofallon]

Context

Hola server spec 004 (try-hola/hola#426) makes acceptor participation in the backup@1 contract a list: the manifest backup block may now be either the existing singular object or a plural array of participations, each with its own id:

"accepts": ["backup@1"],
"backup": [
  { "id": "app-db",
    "preHook":  { "service": "postiz-postgres",   "command": ["sh", "-c", "pg_dump … > /backups/postiz.sql"] },
    "postHook": { "service": "postiz-postgres",   "command": ["rm", "-f", "/backups/postiz.sql"] } },
  { "id": "temporal-db",
    "preHook":  { "service": "temporal-postgres", "command": ["sh", "-c", "pg_dump … > /backups/temporal.sql"] },
    "postHook": { "service": "temporal-postgres", "command": ["rm", "-f", "/backups/temporal.sql"] } }
]

The singular form ({ preHook?, postHook? }) stays valid and keeps working unchanged (normalised server-side to a one-element list named default).

The server ships this in packages/server/src/services/core/manifest-backup.ts / @hola/shared/contracts (backupParticipations()); this issue tracks the catalog-side work, which is out of scope for the server change.

What's needed here

1. Manifest JSON schema: accept backup as either the existing singular object or an array of { id, preHook?, postHook? } objects. id is a non-empty string, unique within the array.
2. bin/validate-manifest.mjs (or wherever manifest CI lives): validate the plural form the same way the singular form is validated today (hook shape: service string + non-empty exec-form command).
3. The "runs a database, declares no hooks" warning becomes per recognised database service, using the same closed image-family list the server uses (postgres, postgresql, pgvector, postgis, timescaledb, mysql, mariadb, percona, mongo, mongodb, mssql, cockroachdb, couchdb — matched on the last path segment of the image reference, exact or family-*/*-family). Today the warning is presumably "this app runs a database-shaped image and declares no backup block at all"; it should become "this database service has no participation whose preHook.service names it," so a two-database app with one hook still gets warned about the second.

Why

Without the catalog accepting the plural form, no bundle can actually adopt multi-participation backup — postiz (see try-hola/hola#426 and the sibling issue for postiz's temporal-postgres hook) is the motivating case: it runs two databases today and only one is ever declared to backup@1, so the dashboard's coverage view (spec 004) will keep reporting it as partially covered until this lands and postiz's manifest adds the second participation.

References

• Capability contracts: support multiple participations per contract per app (postiz has an uncovered database) hola#426 (plural participation)
• ADR 0004 §9 (docs/adr/0004-capability-contracts.md), amended by spec 004
• specs/004-contract-cardinality/contracts/manifest.md in try-hola/hola