[0 BOUNTY] [Python] Add dry-run restore validation to legacy migration tool

[Saiaaax]

Summary

Implements a dry-run restore validation path for the legacy migration tool (tools/legacy_migration.py) that checks backup presence, target compatibility, and expected row-count/checksum metadata without modifying production data.

Closes #20

Changes

• Added: DryRunRestoreResult dataclass — Structured result with valid, errors, warnings, row_counts, checksums, schema_version, target_compatible, backup_present, and metadata fields
• Added: dry_run_restore_validation() function — Performs 5 validation checks:
  1. Backup directory exists (BACKUP_NOT_FOUND)
  2. Manifest file exists and is valid JSON (MANIFEST_MISSING, MANIFEST_INVALID)
  3. Schema version compatibility (SCHEMA_MISMATCH, SCHEMA_UNKNOWN, SCHEMA_UNSUPPORTED)
  4. Row-count and checksum metadata extraction from manifest
  5. Referenced data files exist (DATA_FILES_MISSING)
• Added: dry-run-restore CLI subcommand — python3 legacy_migration.py dry-run-restore --backup-dir DIR --migration-id ID [--target-schema-version VER]
• Added: tests/test_dryrun_restore.py — 12 unit tests covering:
  • Successful dry run with valid backup
  • Metadata and row-count/checksum extraction
  • Missing backup directory
  • Missing manifest file
  • Invalid manifest JSON
  • Schema version mismatch
  • Unknown schema version in manifest
  • Unsupported schema version
  • No target schema version (skip compatibility check)
  • Missing referenced data files
  • No validation metadata (warnings only)
• Updated: docs/OPERATIONS.md — Added "Dry-Run Restore Validation" section with usage, validation checks table, and supported schema versions

Testing

cd tests && python -m pytest test_dryrun_restore.py -v
# 12 passed in 0.16s

Build diagnostic:

python3 build.py -m backend,market,frailbox
# diagnostic/build-db991709.logd generated

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated
• Changes are scoped to the PR purpose
• Security, privacy, and error-handling implications have been considered

---

Payout address: 0x5253757322092903C2F0a8EfEed592344216CC7E
Diagnostic artifact reference: diagnostic/build-db991709.logd