Agent notes

Keep runtime configuration in SQLite only. Do not add .env, YAML, JSON, TOML, or other runtime config files.
Do not use Docker or add distributed-worker infrastructure.
Do not call vzdump directly. Use pvesh for backup operations.
Do not require a crypt remote. Plain OneDrive remotes and crypt remotes are both allowed.
Do not use rclone sync. Use exact-object operations: copyto, existence check, and deletefile.
Never delete a local archive unless upload completed and the remote object was verified.
Mock pvesh and rclone in automated tests. Manual integration testing is limited to scripts/integration-test-adguard.sh.