=== D7 DELETE / soft-delete / retention ===
internal/artifactvault/registry.go:265:			source_run_id, payload_sha256, terminal_state, policy_version, publication_status, retention_class
internal/artifactvault/registry.go:296:		       terminal_state, policy_version, publication_status, retention_class, requested_at
internal/artifactvault/types.go:134:	RetentionClass        string           `json:"retention_class,omitempty"`
---backup---
3:# 系统业务库备份脚本 (backup-system-db.sh)
7:#   2. 采用 pg_dump -Fc 导出系统业务库（含 task_runs、工作流治理等）；
11:#   ./scripts/backup-system-db.sh <dev|test|main> <目标备份目录>
15:#   2. ${HOME}/.secrets/backup-env 中 SYSTEM_DB_PASSWORD_<ENV>
17:# 当前实现经 docker exec 以库内角色执行 pg_dump，通常不需要宿主机口令；
32:    $0 dev ./backups/system_dev_20260912
33:    $0 test /tmp/agent_system_test_backup
36:    SYSTEM_DB_PASSWORD 或 \${HOME}/.secrets/backup-env 或 configs/.env.<env>
81:    local secrets_file="${HOME}/.secrets/backup-env"
115:# 仅保留变量供未来宿主机连接扩展；当前 pg_dump 走容器内角色。
161:echo "[导出] pg_dump -Fc ${DB_NAME} ..."
163:docker exec "${CONTAINER_NAME}" pg_dump -U "${DB_USER}" -d "${DB_NAME}" -Fc -Z 6 -f "${TMP_CONTAINER_DUMP}"
---log driver---
