feat(ops): protect complete pre-deploy recovery set

deploy/README.md

@@ -193,7 +193,11 @@ deploy if the backup fails**. Nothing else in the deploy runs without a restore
 - **Selection:** driven solely by `DATABASE_PROVIDER`, which must be set.
   - `mariadb` / `mysql` → SQL dump, `jobtracker-<database>-<UTC timestamp>.sql.gz`, e.g.
     `jobtracker-jobtracker-20260719T153759Z.sql.gz`
+  - MariaDB deployments also archive `jobtracker_data`, which contains attachments, imported CVs,
+    generated exports and Data Protection keys.
   - `sqlite` → data volume archive, `jobtracker-sqlite-<UTC timestamp>.tar.gz`
+  - every deployment archives the separate account-deletion tombstone volume when it exists;
+    restore it independently and never replace it with an older application-data snapshot
   - anything else → the deploy stops
 - **The filename tells you which path ran.** If you expect a MariaDB deploy and find a
   `jobtracker-sqlite-*.tar.gz`, the environment is wrong — that is the exact failure this check exists
@@ -215,6 +219,7 @@ like a restore point.
 |---|---|
 | MariaDB | non-empty; valid gzip; contains `CREATE TABLE`; contains the `Dump completed` trailer that `mariadb-dump` writes last, so a dump that died partway through is rejected |
 | SQLite | non-empty; valid gzip; the archive actually contains `jobtracker.db` |
+| Recovery volumes | non-empty valid gzip archives; a missing required application-data volume aborts the deploy |
 
 A failed check deletes the file rather than leaving something that looks like a backup.