[imbajin]

Purpose of the PR

A restore worker could fail while reading a damaged JSON/ZIP file or inserting records, yet the command would report success and clean its input directory. Worker failures now reach the existing CLI error path after all submitted work finishes, and failed restores retain their inputs.

Found in the Toolchain integration report.

Main Changes

• Propagate restore worker failures through their Futures.
• Drain all tasks before reporting the first failure and retaining later failures as suppressed exceptions.
• Preserve interruption through cleanup and cover damaged input, rejected writes, failure cleanup and valid empty backups. No new backup format or missing-file inference is added.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests.
• Need tests and can be verified as follows:
  • Targeted Java 17 Maven tests pass with actual corrupt JSON/ZIP files, asynchronous failures and interruption. The original production classes fail the corresponding negative controls.
  • The legitimate empty backup remains valid; clean=true retains input after a failed restore.
  • Checkstyle and three independent read-only reviews passed.
  • Original and fixed native CLI packages pass the paired real Server acceptance: damaged JSON/ZIP returns success and deletes inputs before the fix, versus Unix exit 255 and retained input hashes after it. Legal empty backup/restore still succeeds; full functional regressions and upstream core CI pass.

Does this PR potentially affect the following parts?

• Nope
• Dependencies
• Modify configurations
• The public API
• Other affects

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need: restores the existing CLI failure and cleanup contract.

Organization and upstream core CI pass. Original and fixed native packages use the same verified Server SDK and fixture; task-owned graphs and services are cleaned up after acceptance.

The native CLI checks answer n to its existing optional stack-trace prompt before verifying the Unix error exit; this PR preserves that prompt contract.