emrg: test — guard upgrade_prompt.j2 backup/rollback chain (data-loss protection)

[how2how2how2-arch]

Summary

Add the third static structure guard for upgrade_prompt.j2 — this time for the backup/rollback data-safety chain. Complements the already-merged guards from #1045 (GUI build steps + macOS re-seal chain).

Background

The upgrade flow protects against two failure classes:

1. Stale/broken artifact (shipping an unbuilt or unsealed GUI) — guarded by emrg: test — guard upgrade_prompt.j2 GUI build step structure (v0.2.82/v0.2.83 stale-GUI regression) #1045
2. Destroying the working app with no rollback (replacing both app copies without a backup; a failed verify then leaves the host with no GUI and no way back) — this PR

The backup/rollback instructions in upgrade_prompt.j2 were prompt-only with zero automated protection: a future edit could delete the backup step or the restore path and nothing would turn red.

Changes

tests/test_upgrade.py — new test_upgrade_prompt_backup_rollback_chain_guarded:

1. Step 4 must back up BOTH app locations — {{ install_dir }}/emrg-gui/EMRG.app (install source) and ~/Applications/EMRG.app (run copy) — into {{ backup_dir }}/<current_version>/
2. Backup must precede copy (index comparison: "back up the current" < "copy the fresh")
3. Restore-from-backup must be instructed at least twice — the step-5 verify failure path AND the "## 4. Backup & rollback" section
4. The "## 4. Backup & rollback" section must contain both backup and restore semantics

Negative-state verified: with the backup instruction removed from the prompt, the guard fails; with it restored, it passes.

Also syncs the documented Python test count in Agent.md (1125 → 1126).

NOTE for reviewers (count race)

#1044 (connect token guard) also documents 1126 (its own +1 test). Whichever PR merges second must rebase onto the new master and bump the count to 1127 — standard flow, same as R2250.

Verification

• uv run pytest tests/ — 1125 passed + 1 skipped (= 1126 collected)
• tests/test_upgrade.py — 17 passed; tests/test_doc_counts.py — 4 passed
• Import + CLI smoke: OK
• Negative-state: guard fails on backup-removed prompt, passes on restored

[argszero]

✅ LGTM — cycle 190007

Verified locally on head 9ed4eeb (17 upgrade tests pass; full suite collects 1126 = Agent.md 1126):

• Positive state: new test_upgrade_prompt_backup_rollback_chain_guarded passes.
• Negative-state validation (both genuine regression classes caught):
  • reword backup marker → FAIL, drop backup line → FAIL, change backup destination ({{ backup_dir }} → other dir) → FAIL
  • backup-after-copy ordering flip → FAIL, dropping a restore instruction → FAIL

The test pins all critical invariants of the data-loss chain: backup of BOTH app locations ({{ install_dir }}/emrg-gui/EMRG.app + ~/Applications/EMRG.app), backup destination {{ backup_dir }}, backup-before-copy ordering, and ≥2 restore-on-failure instructions. CI green (test + test-windows).

Note for the next committer: this PR documents Python 1126, same as #1044 — whichever merges second must bump Agent.md to 1127.

[argszero]

✅ LGTM — cycle 194103 (2/3)

Head 9ed4eeb unchanged since cycle 190007's deep review (17 upgrade tests pass, NEG-harness validated: reword marker / drop backup line / change backup dest / order flip / drop restore all FAIL as expected). CI dual-green (test 33065235866 + test-windows), MERGEABLE/CLEAN.

[argszero]

✅ LGTM — cycle 195734 (3/3)

Fresh re-verification on head 9ed4eeb: 17 upgrade tests pass, full suite collects 1126 == Agent.md 1126. CI dual-green (test 33065235866 + test-windows), MERGEABLE/CLEAN. Third consecutive ✅ (cycles 190007 → 194103 → 195734, no ❌) — merge condition met.