fix(db): WAL-safe safety backup + tests for validate-first and zip-traversal guard

sfm/db_snapshot.py

@@ -78,7 +78,7 @@ def restore_db_and_waveforms(db_path: Path, waveform_root: Path,
     if db_path.exists():
         ts = datetime.datetime.utcnow().strftime("%Y%m%d_%H%M%S")
         safety = db_path.with_name(f"{db_path.name}.pre-restore-{ts}")
-        shutil.copy2(db_path, safety)
+        snapshot_db(db_path, safety)
         safety_name = safety.name
 
     # Clear the OUTGOING db's WAL sidecars so they cannot attach to the incoming file.