Three-phase restore header validation always reports success without reading records

[sionsmith]

Problem

ThreePhaseRestore::validate_phase1_headers currently returns a placeholder success response:

• has_offset_headers: true
• has_timestamp_headers: true
• sample_records_checked: 0
• no warnings

It does not read the backup. A caller can therefore receive a positive validation result for a backup that lacks the required x-original-offset/x-original-timestamp metadata.

The method currently has no production call sites, which also means the promised preflight is not protecting the CLI workflow.

Acceptance criteria

• Inspect records from every selected topic/partition, or use authenticated manifest metadata that proves tracking-header coverage.
• Validate required offset and timestamp metadata according to the restore configuration.
• Treat zero records checked as not-applicable or indeterminate, never a positive pass.
• Return per-topic/partition coverage and actionable warnings/errors.
• Wire the validation into validate-restore and/or three-phase-restore preflight.
• Fail before writing target records when offset recovery was requested but required metadata is absent.
• Add tests for present, missing, partially present, legacy, empty, and corrupt backups.

[sionsmith]

Tracked by the production-ready Confluent cyber-recovery delivery epic: https://github.com/osodevops/kafka-backup-enterprise/issues/14