feat(s2): add Gitea SSH NodePort service + close WP-0004 (backup tool, scope updates)

- helm/gitea-ssh-nodeport.yaml: expose Gitea SSH on NodePort 30022 (targetPort 2222)
  for on-node git automation (RAIL-HO-WP-0004-T07)
- tools/cmd/railiance-backup-s2: fix SQLite hot backup (was broken etcd-snapshot)
- tools/cmd/railiance-restore-s2: update restore instructions for SQLite mode
- workplans/RAIL-BS-WP-0004-safety-net.md: mark done
- SCOPE.md: update current state, document boundary violations, fix connectivity docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/RAIL-BS-WP-0004-safety-net.md

@@ -4,12 +4,12 @@ type: workplan
 title: "Integrated Backup — S2 Kubernetes Runtime Layer"
 domain: railiance
 repo: railiance-cluster
-status: active
+status: done
 owner: tegwick
 topic_slug: railiance
 state_hub_workstream_id: "7e8b0c20-51eb-40c9-9e3b-85dd380d7625"
 created: "2026-02-25"
-updated: "2026-03-10"
+updated: "2026-03-26"
 ---
 
 # Integrated Backup — S2 Kubernetes Runtime Layer
@@ -84,7 +84,7 @@ No special protocol needed — just the standard interface.
 
 ```task
 id: T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4526a842-ea31-4874-9231-92ab556cfe7b"
 ```
@@ -107,11 +107,11 @@ appear in `/opt/backup/railiance/cluster/`.
 
 ---
 
-### T02 — Back up k3s etcd snapshots
+### T02 — Back up k3s state (SQLite hot backup)
 
 ```task
 id: T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "a6313e06-1976-46a7-8e31-df4eb2eca880"
 ```
@@ -142,7 +142,7 @@ copy to `/opt/backup/railiance/cluster/`.
 
 ```task
 id: T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "05d42a55-921f-4aa7-bb76-e8af9c7e0ac3"
 ```
@@ -172,7 +172,7 @@ Tar and age-encrypt into `helm-values-<ts>.tar.gz.age`.
 
 ```task
 id: T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "08233868-d522-4117-bc4e-6c0f52545665"
 ```
@@ -188,7 +188,7 @@ into `kubeconfig-<ts>.yaml.age` in the backup directory.
 
 ```task
 id: T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "2d5acff7-4a4e-4ddd-ad06-08237ad3dac8"
 ```
@@ -210,7 +210,7 @@ sudo k3s server --cluster-reset \
 
 ```task
 id: T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "f8e4a094-c367-40eb-b895-da17bc144b07"
 ```