R18 R06 methods and limitations

- VM101 remains BusyBox/OpenWrt and remote scripts are POSIX `/bin/sh`.
- The active-link raw target is restored from the R04 installation backup, not reconstructed manually.
- Quarantine is restored only when the R04 backup and R04 attempt snapshot are byte-identical.
- Counter value is restored from R04 backup and cross-checked against `state.kv`.
- No provider operation, generation build, activation, interface restart, or Machine Git publication is allowed.
- The manual rollback intentionally returns to the damaged state and therefore requires explicit confirmation.