fix(backup): the safety backup's audit row names who restored (#5820)

On the live restore the "before restore" backup.made row read user
"unknown": _safety_backup recorded it with no username. It now carries
the person who started the restore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_restoring.py

@@ -65,8 +65,8 @@ def _stub(monkeypatch, tmp_path, *, restore_error=None, key="k-backup"):
     from steward.core import audit
     seen = {"audits": [], "restarts": 0}
 
-    async def safety(app):
-        seen["safety"] = True
+    async def safety(app, username):
+        seen["safety"] = username
         return "steward-20261015T140000Z.tar"
 
     async def in_place(path, url, plugin_dirs=None):
@@ -97,7 +97,7 @@ async def _restore(tmp_path):
 async def test_a_restore_saves_a_safety_backup_puts_the_key_in_place_and_restarts(monkeypatch, tmp_path):
     seen = _stub(monkeypatch, tmp_path)
     await _restore(tmp_path)
-    assert seen["safety"] and seen["restarts"] == 1
+    assert seen["safety"] == "admin" and seen["restarts"] == 1       # its audit row names who restored
     assert (tmp_path / "secret.key").read_text() == "k-backup"
     [(action, detail)] = seen["audits"]
     assert action == "backup.restored"