v22.0.4 backport batch 2: backup & security hardening

[sbaker617]

What's this?

Batch 2 of 4 for the v22.0.4 upstream backport. Backup correctness fix + security hardening across all backup engines.

Commits (in order)

PR	Score	Description
vitessio#19336	8	fix(backup): propagate file hashes to manifest after retry
vitessio#19460	9	Restore: make loading compressor commands from MANIFEST opt-in
vitessio#19479	9	filebackupstorage: use SafePathJoin for all path building
vitessio#19484	7	mysqlshellbackupengine: use SafePathJoin to build path
vitessio#19486	9	vttablet: harden ExecuteHook RPC and backup engine flag inputs

Notes

• All cherry-picks applied cleanly — mysqlshellbackupengine: use fileutil.SafePathJoin(...) to build path vitessio/vitess#19484 was applied before vttablet: harden ExecuteHook RPC and backup engine flag inputs vitessio/vitess#19486 to avoid a conflict in mysqlshellbackupengine.go
• Completes the security sweep started by backupengine: disallow path traversals via backup MANIFEST on restore vitessio/vitess#19470 (already in our fork)
• Local go build ./go/... passes clean
• Upstream comparison: vitessio/vitess@v22.0.3...v22.0.4

Full upgrade plan

https://gist.github.com/sbaker617/4abb0e0c1856cce1b297b64e6353ec3d

---

Cherry-picked by Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 50.63291% with 39 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (slack-22_0_4-wip@5e7acd3). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
go/vt/mysqlctl/mysqlshellbackupengine.go	41.02%	23 Missing ⚠️
go/vt/mysqlctl/xtrabackupengine.go	0.00%	13 Missing ⚠️
go/vt/mysqlctl/filebackupstorage/file.go	66.66%	2 Missing ⚠️
go/vt/hook/hook.go	66.66%	1 Missing ⚠️

Additional details and impacted files

@@                 Coverage Diff                 @@
##             slack-22_0_4-wip     #830   +/-   ##
===================================================
  Coverage                    ?   69.81%           
===================================================
  Files                       ?     1606           
  Lines                       ?   214177           
  Branches                    ?        0           
===================================================
  Hits                        ?   149534           
  Misses                      ?    64643           
  Partials                    ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.