Problem

RustFS addon currently lacks a DataProtection backup/restore surface for protecting RustFS object data through KubeBlocks. Before this change, the chart does not provide a RustFS BackupPolicyTemplate, matching backup/restore ActionSet, or dataprotection scripts for exporting and replaying S3 objects.

This leaves a coverage and operations gap: users can create and operate RustFS clusters, but cannot run a RustFS-specific logical backup through a real BackupRepo and restore the backed-up objects into a new RustFS cluster.

Test scenario / reproduction

On the RustFS addon before PR #2994:

1. Install the RustFS addon and create a RustFS cluster.
2. Create marker buckets/objects through the RustFS S3 API.
3. Check for a RustFS BackupPolicyTemplate / ActionSet backup method.
4. Try to run a KubeBlocks DataProtection backup/restore flow for RustFS object data.

Expected behavior:

• The addon exposes a RustFS backup method.
• KubeBlocks can generate a BackupPolicy for a RustFS cluster.
• A Backup CR can export bucket/object data into a BackupRepo.
• Restore logic can replay the exported bucket/object data into a fresh RustFS cluster.

Observed before the implementation:

• No RustFS-specific BackupPolicyTemplate exists.
• No RustFS backup/restore ActionSet exists.
• No RustFS backup/restore dataprotection scripts exist.
• A runtime backup/restore lane cannot be written against the addon without first adding those addon surfaces.

Proposed solution

Add logical S3 full-backup support to the RustFS addon:

• BackupPolicyTemplate: rustfs-backup-policy-template
• ActionSet: rustfs-s3-full-br
• Backup script that exports buckets and objects through the RustFS S3 API into BackupRepo artifacts
• Restore script that validates the manifest and replays objects into the target RustFS cluster
• Fail-closed manifest/object validation before restore mutates target buckets

The intended method name is s3-full. It should be a logical S3 export/import path, not a CSI volume snapshot claim.

Evidence and acceptance boundary

PR #2994 adds the addon-side surface and local/static tests. Current runtime evidence is partial:

• B01 logical backup path has been verified on PR feat(rustfs): add logical s3 backup actionset #2994 head 9d96595c with a real BackupRepo and artifact verification.
• Cluster.spec.restore.source end-to-end restore is still environment-blocked in the current vcluster by a PVC sync-loop error.
• Manual ActionSet artifact replay validates the restore script/artifact logic, but does not replace full KubeBlocks restore-controller E2E evidence.
• TLS/server certificate trust validation remains a separate follow-up.

Related PR

PR #2994 implements the initial addon-side support.