fix(recovery): resolve metadata MAC desync after recovery (R-NEW-1) & complete release workflow (CI-01)

- R-NEW-1: Recalculate metadata HMAC upon recovery-key restore and mark backup restores as PendingRebuild to rebuild transparently on first mount
- CI-01: Update release.yaml to compile both Windows x86_64 and Linux musl with pinned Zig 0.16.0 and cargo-zigbuild 0.23.4
- W-1: Implement statvfs quota determination on Unix via libc
- Add RELEASE_PROCESS.md documenting release architecture and steps
- Bump version to 0.9.2 across manifests, lockfile, docs, Scoop and WinGet

src/recovery.rs

@@ -412,6 +412,11 @@ pub fn restore_slot_from_recovery_key(
     db.restore_meta(&meta)
         .context("Fehler beim Schreiben des rekonstruierten Headers")?;
 
+    // R-NEW-1: Metadaten-MAC für den wiederhergestellten Slot unmittelbar berechnen und persistieren
+    db.set_active_slot_and_dek(target_slot_id, dek.clone());
+    db.update_metadata_mac()
+        .context("Fehler beim Aktualisieren des Metadaten-MAC nach Header-Rekonstruktion")?;
+
     db.checkpoint()
         .context("Fehler beim WAL-Checkpoint nach Header-Rekonstruktion")?;
 
@@ -561,6 +566,16 @@ mod tests {
         .expect("Unwrap restored DEK");
         assert_eq!(*dek, *active_dek);
 
+        // R-NEW-1: Nach restore_header_backup muss der MAC-Status PendingRebuild sein
+        let mac_status = restored_db
+            .verify_metadata_mac_status_for_slot(0, &active_dek)
+            .expect("Verify MAC status");
+        assert_eq!(
+            mac_status,
+            crate::storage::MetadataMacStatus::PendingRebuild,
+            "Nach Header-Restore ohne Plaintext-DEK muss MAC-Status PendingRebuild sein"
+        );
+
         let _ = fs::remove_file(&container_path);
         let _ = fs::remove_file(&backup_path);
     }
@@ -618,6 +633,19 @@ mod tests {
         .expect("Unwrap rescued DEK");
         assert_eq!(*dek, *unwrapped);
 
+        // R-NEW-1: Nach recovery key restore muss der MAC sofort gültig und persistent sein
+        let mac_status = rescued_db
+            .verify_metadata_mac_status_for_slot(0, &unwrapped)
+            .expect("Verify MAC status");
+        assert_eq!(
+            mac_status,
+            crate::storage::MetadataMacStatus::Valid,
+            "Nach Recovery-Key-Restore muss MAC sofort Valid sein"
+        );
+        assert!(rescued_db
+            .verify_metadata_mac_for_slot(0, &unwrapped)
+            .unwrap());
+
         let _ = fs::remove_file(&container_path);
     }
 }