Back up protected paused account handover with create-only readback

[Pigbibi]

Changes

• Add a manual-only, default-off handover backup mode to the existing protected preflight job.
• Validate the transferred state and protected target, create one immutable backup only after a clear absent-object check, and verify the original bytes through an independent readback.
• Preserve the read-only mode and skip balance publishing, runtime traffic changes, Scheduler operations and broker calls.

Upload and readback uncertainty stops the operation without retrying or replacing an object. The destination prefix comes from a protected Secret.

Validation

• 79 relevant tests passed.
• Ruff, actionlint and diff checks passed.
• Real Runner creation and readback remain to be verified after merge.