Harden remote verification against environment overrides and marker normalization

usr-local-sbin/app-backup.sh

@@ -104,8 +104,15 @@ if [[ $ENABLE_UPLOAD == true ]]; then
   rc check "$RUN_DIR" "$remote_run" --download --exclude /COMPLETE --exclude /UPLOADED
   echo '-- Remote readback passed; publishing completion marker'
   rc copyto "$RUN_DIR/COMPLETE" "$remote_run/COMPLETE" --immutable
-  marker=$(rc cat "$remote_run/COMPLETE")
-  [[ $marker == "$(cat "$RUN_DIR/COMPLETE")" ]] || die 'Remote completion marker mismatch'
+  # Command substitution strips trailing newlines, which could accept a marker
+  # that the strict restore parser rejects. Compare the exact returned bytes.
+  rc cat "$remote_run/COMPLETE" > "$STAGING_DIR/remote-COMPLETE"
+  python3 - "$RUN_DIR/COMPLETE" "$STAGING_DIR/remote-COMPLETE" <<'PY' || die 'Remote completion marker mismatch'
+from pathlib import Path
+import sys
+local, remote = map(Path, sys.argv[1:])
+sys.exit(0 if local.stat().st_size == remote.stat().st_size and local.read_bytes() == remote.read_bytes() else 1)
+PY
   date -u -Is > "$RUN_DIR/UPLOADED"
   sync -f "$RUN_DIR"
   echo '-- Remote backup fully read back and verified'