fix(vector): harden backup restore parity gates

scripts/vector-backup.sh

@@ -25,12 +25,16 @@ done
 [ -n "$password_file" ] && [ -n "$output" ] || usage
 validate_secret_file "$password_file" "backup password file"
 [ ! -e "$output" ] || { echo "refusing to overwrite existing backup: $output" >&2; exit 2; }
+output_dir=$(dirname "$output")
+output_name=$(basename "$output")
+[ -d "$output_dir" ] || { echo "backup destination directory does not exist" >&2; exit 2; }
 
 password=$(read_secret_file "$password_file" "backup password file")
 
 umask 077
 passfile=$(mktemp "${TMPDIR:-/tmp}/thoth-vector-pgpass.XXXXXX")
-cleanup() { rm -f "$passfile" "$output.partial"; }
+temporary_output=$(mktemp "$output_dir/.${output_name}.tmp.XXXXXX")
+cleanup() { rm -f "$passfile" "$temporary_output"; }
 trap cleanup EXIT HUP INT TERM
 escaped=$(printf '%s' "$password" | sed 's/\\/\\\\/g; s/:/\\:/g')
 printf '%s:%s:%s:%s:%s\n' "$host" "$port" "$database" "$user" "$escaped" >"$passfile"
@@ -40,6 +44,6 @@ PGPASSFILE=$passfile pg_dump \
   --host="$host" --port="$port" --username="$user" --dbname="$database" \
   --format=custom --compress=9 \
   --table=vectors.schema_records --table=vectors.evidence --table=vectors.memory \
-  --table=public.tht_vector_migrations --file="$output.partial"
-mv "$output.partial" "$output"
+  --table=public.tht_vector_migrations --file="$temporary_output"
+mv "$temporary_output" "$output"
 echo "Vector backup written: $output"