chore(release): 0.11.0-rc.8

[pofallon]

What's in it

Three backup@1 fixes from an end-to-end audit of the contract. The platform half of backup was already built; these are the gaps that made it not work, or not tell the truth about itself.

#470	DATABASE_IMAGE_FAMILIES was missing pgautoupgrade — the Postgres image every catalog app but immich runs. guacamole, mealie, paperless-ngx and postiz therefore reported recognised: 0, which with participations declared renders as quiesced: the all-clear. The four apps that actually declare backup hooks were the four whose coverage was never judged.
#471	A contract-scoped token could GET the whole API. The capability table names capabilities only for mutating routes, so every read required none and the middleware skipped the check — the credential injected into a catalog container could read /api/deployments, another app's logs, /api/settings and every job. Now closed by default.
#472	The prepare timeout ADR 0004 §6 has always required, and which backrest's shipped hook script already told its reader the server applied. A provider that died mid-capture left a pg_dump in every accepting app's data root — and those roots are what the next backup captures, so the stale dump rode into every later snapshot looking fresh. Plus ContractRollup.activity, so the Backups page can say "has never announced a backup".

Why an operator wants this one

If you run postiz, its temporal-postgres is copied live on every backup and rc.7 renders the app as quiesced anyway. #470 makes that visible; postiz 2.1.0 in the catalog fixes it.

Pairs with two catalog releases published today:

• backrest 2.1.0 (fix(backrest): register the backup-contract hooks, don't just write them (2.1.0) apps#162) — registers its backup hooks with Backrest instead of only writing them to disk. Before this, unless the operator hand-wired two Command hooks in the UI, the broker was never called and every snapshot was a live-file copy. Works on any Hola version; fix(backup): expire a prepare the provider never finalizes, and say when it last ran #472 is what surfaces a provider that has never announced a run.
• postiz 2.1.0 (feat(backup): plural participations, per-database coverage (postiz 2.1.0) apps#163) — the first bundle to use plural backup participations.

Verified

bun run typecheck · lint · test (1004 server + 360 web) · build — green, re-run on the combined main because each PR's CI ran against an older base.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vck5KSX2CLxhohx14nb5Sh