Fix SELinux backup execution context and probe source metadata before downtime

usr-local-sbin/app-restore.sh

@@ -53,7 +53,7 @@ else
   input_real=$(realpath -e "$LOCAL_RUN")
   stage_real=$(realpath -e "$STAGING_DIR")
   [[ $stage_real != "$input_real" && $stage_real != "$input_real/"* ]] || die 'Backup source contains restore workspace'
-  rsync -a -- "$LOCAL_RUN/" "$INPUT/"
+  rsync -a -- "$LOCAL_RUN/" "$INPUT/" 8>&- 9>&-
 fi
 if [[ $LEGACY == true ]]; then
   echo 'WARNING: Legacy backup has no trusted manifest/completeness proof.'
@@ -172,7 +172,7 @@ for i in "${!SELECTED[@]}"; do
   else
     exclusions "$label"
     if [[ $RESTORE_STRICT_DELETE == true ]]; then EXCLUDES+=(--delete-delay); fi
-    rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$source_path/" "${TARGETS[i]}/"
+    rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$source_path/" "${TARGETS[i]}/" 8>&- 9>&-
   fi
 done
 # A backup captured maintenance=true. Enforce the recorded pre-restore state even