docs(wp-0004): add implementation notes for sudo, etcd, helm, cron

T02: note to verify etcd is in use before implementing; flags root requirement
T03: add KUBECONFIG to helm commands; note root access approach
T06: document solution to sudo problem — run cron under root's crontab,
     not a sudoers whitelist. Add restore drill commands. Fix cron to use
     absolute path (~ unreliable in root crontab).
T01: note to remove old railiance-backup script (wrong scope)
Makefile: fix stale backup description, add restore target, fix .PHONY

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Makefile

@@ -4,8 +4,11 @@ INVENTORY ?= ansible/hosts.ini
 
 ##@ Safety Net
 
-backup: ## Backup postgres + config to Nextcloud (age-encrypted)
-	bin/railiance backup
+backup: ## Backup k3s etcd + Helm values + kubeconfig (age-encrypted, root required)
+	tools/cmd/railiance-backup-s2
+
+restore: ## List available backups and print restore guide
+	tools/cmd/railiance-restore-s2
 
 preflight: ## Pre-migration safety gate — must pass before cluster work
 	bin/railiance preflight
@@ -28,4 +31,4 @@ help: ## Show this help
 	  /^[a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
-.PHONY: k3s-install smoke test-ha-failover help
+.PHONY: backup restore preflight k3s-install smoke test-ha-failover help