fix(format-v3): harden system binding against replay and bypass attacks (F-01, F-02, F-03)

- F-02: Require restore_nonce token and explicit confirmation (--rebuild-mac) for PendingRebuild
- F-01: Extend canonical MAC transcript to include chunk generation tuples (node_id, chunk_index, generation) and support transparent legacy migration
- F-03: Make V2-to-V3 container upgrade atomic with transactional rollback and dual-slot version update
- Bump version to 0.9.4 and update changelog and security docs

src/recovery.rs

@@ -3,6 +3,8 @@ use std::path::Path;
 use std::time::{SystemTime, UNIX_EPOCH};
 
 use anyhow::{bail, Context, Result};
+use rand::rngs::OsRng;
+use rand::RngCore;
 use serde::{Deserialize, Serialize};
 
 use crate::crypto::{
@@ -276,7 +278,10 @@ pub fn restore_header_backup(container_path: &Path, backup_path: &Path) -> Resul
 
     let db = Database::open(container_path).context("Konnte Ziel-Containerdatei nicht öffnen")?;
 
-    db.restore_meta(&meta)
+    let mut restore_nonce = [0u8; 32];
+    OsRng.fill_bytes(&mut restore_nonce);
+
+    db.restore_meta_with_nonce(&meta, Some(&restore_nonce))
         .context("Fehler beim Wiederherstellen der Header-Tabelle in der Datenbank")?;
 
     db.checkpoint()