backup pipeline: flock manifest + cap + drop LAN -z

Three more audit fixes from the 2026-05-24 backup-pipeline review:

#5 (S1 race) — manifest flock
  daily-backup and nfs-mirror both append to /mnt/backup/.changed-files.
  If they overlap (nfs-mirror Mon 04:11 running long, daily-backup
  starting Mon 05:00), concurrent appends from `find | tee` and
  `find | sed >>` could interleave mid-line — partial paths would slip
  past rsync's --files-from. Both scripts now share a manifest_append()
  helper using `flock -x` on /mnt/backup/.changed-files.lock. The 4
  daily-backup call sites + the 1 nfs-mirror call site all pipe through
  it instead of redirecting directly.

#7 (S2 unbounded manifest)
  daily-backup gains check_manifest_size() invoked after the PVE-config
  append (the last manifest writer of the run). Above MANIFEST_MAX_LINES
  (500k) it touches /mnt/backup/.force-full-sync — offsite-sync's Step 1
  now treats that flag the same as day-of-month ≤ 7 (full sync with
  --delete) and clears it on success. Catches the "Synology unreachable
  for many days" edge case where the manifest would grow unbounded.

#9 (wear — drop -z on LAN hops)
  offsite-sync rsync calls to Synology over the same 192.168.1.0/24
  gigabit LAN had `-rltz`. Compression burns CPU on the PVE host (already
  IO-busy) and gives nothing on a saturated GigE link. Dropped to `-rlt`
  on all 5 offsite rsync invocations (Step 1 full + Step 1 incremental +
  Step 2 full nfs + Step 2 full nfs-ssd + Step 2 incremental).

Other adjustments:
- nfs-mirror's find-after-rsync now also excludes the new state files
  (.changed-files.lock, .force-full-sync) when populating the manifest.
- offsite-sync Step 1 full-sync excludes the same .force-full-sync flag
  so it doesn't ship to Synology.

Deployed to PVE host (/usr/local/bin/{daily-backup,nfs-mirror,
offsite-sync-backup}). Currently in-flight nfs-mirror run is unaffected
(bash loaded the old script into memory at start). Next runs use the
new behaviour.

Refs: 2026-05-24 audit Section 2 items #1 (manifest race), #4 (unbounded
manifest), #6 (LAN -z wear).

scripts/nfs-mirror.sh

@@ -81,6 +81,17 @@ EXCLUDES=(
 log()  { echo "[$(date -u '+%Y-%m-%dT%H:%M:%SZ')] $*" | tee -a "$LOG"; }
 warn() { log "WARN: $*"; }
 
+# Locked manifest append (shared with daily-backup) — see daily-backup.sh
+# for the rationale. flock prevents interleaved appends when nfs-mirror
+# (Mon 04:11) overruns into daily-backup (Mon 05:00).
+MANIFEST_LOCK="${MANIFEST}.lock"
+manifest_append() {
+    (
+        flock -x 200
+        cat >> "${MANIFEST}"
+    ) 200>"${MANIFEST_LOCK}"
+}
+
 push_metrics() {
     local status="${1:-0}" bytes="${2:-0}"
     cat <<EOF | curl -s --connect-timeout 5 --max-time 10 --data-binary @- "${PUSHGATEWAY}/metrics/job/${PUSHGATEWAY_JOB}" 2>/dev/null || true
@@ -132,10 +143,12 @@ if [ "$RSYNC_RC" -eq 0 ]; then
     # manifest so daily Step 1 incremental picks them up tomorrow morning.
     NEW_COUNT=$(find /mnt/backup -newer "$STAMP" -type f \
         ! -path '/mnt/backup/.changed-files' \
+        ! -path '/mnt/backup/.changed-files.lock' \
         ! -path '/mnt/backup/.lv-pvc-mapping.json' \
         ! -path '/mnt/backup/.nfs-changes.log' \
         ! -path '/mnt/backup/.last-offsite-sync' \
-        -printf '%P\n' 2>/dev/null | tee -a "$MANIFEST" | wc -l)
+        ! -path '/mnt/backup/.force-full-sync' \
+        -printf '%P\n' 2>/dev/null | tee >(manifest_append) | wc -l)
     log "=== mirror complete; ${NEW_COUNT} files added to offsite manifest ==="
     log "/mnt/backup used: $(df -h --output=used /mnt/backup | tail -1 | tr -d ' ')"
     push_metrics 0 "$DST_BYTES"