fix: cover the shutdown calls and check every volume before replacing one

Both shutdown calls sat outside the recovery that undoes them: a `compose down`
that failed partway left the stack down, and a `compose stop` that failed left
the backend and worker stopped. Each now runs inside its own try.

A restore also replaced volumes one at a time, checking each tar as it reached
it, so a damaged third payload was found with the first two already swapped in.
Every declared tar is read through first, and the imports start only once they
all come out whole.

docsgpt/deploy/backup.py

@@ -113,6 +113,16 @@ def validate(path: Path, manifest: Mapping[str, object]) -> list[str]:
     return list(volumes)
 
 
+def check_volume_tar(name: str, path: Path) -> None:
+    """Read a volume tar through, so a damaged one is found before any volume is replaced."""
+    try:
+        with tarfile.open(path, "r:*") as archive:
+            for _ in archive:
+                pass
+    except (tarfile.TarError, OSError) as exc:
+        raise DeployError(f"the {name} volume in this backup is damaged: {exc}") from exc
+
+
 def extract(path: Path, destination: Path) -> None:
     """Unpack the archive into ``destination`` (data filter: no paths outside it, no devices)."""
     with tarfile.open(path, "r:gz") as archive: