Recover backup capacity with verified adaptive retention

Resume pending publications under local pressure, allow verified offsite-only history as a final local recovery stage, and prune old complete remote sets against actual upload quota while preserving the newest verified copies. Document defaults, recovery limits and validation; add pressure and quota regression coverage.

etc/app-backup/app-backup.conf

@@ -17,10 +17,17 @@ LOG_RETENTION_DAYS=30
 LOCAL_RETENTION_DAYS=7
 REMOTE_RETENTION_DAYS=30
 RETENTION_KEEP_LAST=3
-# Under disk pressure only: keep at least this many uploaded local sets.
-# Other local copies require a fresh offsite check before removal; never zero.
-# Set equal to RETENTION_KEEP_LAST to retain the former emergency floor.
+# First pressure stage: retain this many uploaded local sets (minimum one).
+# SPACE_ALLOW_REMOTE_ONLY can release this floor as a last resort.
+# Set SPACE_ALLOW_REMOTE_ONLY=false to enforce it unconditionally.
 SPACE_KEEP_LOCAL=1
+# If the floor prevents a new backup: permit offsite-only history after full
+# local validation + remote sizes/identity checks. false enforces the floor.
+SPACE_ALLOW_REMOTE_ONLY=true
+# Quota-driven offsite cleanup is separate from normal age-based retention.
+# Keeps at least the newest verified complete remote set, including before upload.
+SPACE_REMOTE_CLEANUP=true
+SPACE_KEEP_REMOTE=1
 # Enable deliberately after a successful restore rehearsal. v1 runs are retained.
 ENABLE_REMOTE_RETENTION="false"