Retry restore-test downloads safely and expose bounded diagnostics

lib/restore-test-remote.sh

@@ -19,6 +19,11 @@ if [[ ${1:-} == space ]]; then
   ensure_space "$WORKDIR" "$2"
   exit 0
 fi
+# These reads belong to verification, not upload. Apply the shorter read I/O
+# policy even during crypt preflight. The Python parent owns deadlines/retries
+# and resets partial output before retry; retrying cat here could append bytes.
+RCLONE_TIMEOUT="${RCLONE_CHECK_TIMEOUT}s"
+RCLONE_LOW_LEVEL_RETRIES=$RCLONE_CHECK_LOW_LEVEL_RETRIES
 check_remote >&2
 # rclone is restricted to read operations here, including metadata reads.
 case ${1:-} in lsf|cat) rc "$@" ;; *) die 'Unsupported restore-test remote operation' ;; esac