backhaul-agent: public containerized DB-backup client

One docker run on a database's private network starts backing it up:
- backhaul-agent.py: stdlib-only sidecar — every-minute check-in, app-owned
  dump schedule, streams pg_dump/mysqldump/mongodump home chunked, self-updates.
- entrypoint.sh: bootstraps the newest script, installs the once-a-minute cron
  (sources persisted env), runs once immediately, hands off to cron; logs to a
  file surfaced via docker logs.
- Dockerfile: debian-slim + pg_dump 17 (PGDG — required for Postgres 17 servers)
  + mysql client. Mongo tools to follow.
- CI builds + pushes the public image and asserts the dump tools are present.

README.md

@@ -0,0 +1,50 @@
+# backhaul-agent
+
+The public, containerized client for [backhaul](https://backhaul.skui.io) — a database-backup
+dashboard with proven restore. Run this as a **sidecar on your database's private Docker
+network**: it reaches the database internally and pushes dumps home over HTTPS. **No inbound
+ports are ever opened** — the agent only makes outbound calls.
+
+## How it works
+
+- Once a minute (in-container cron) the agent **checks in**: it heartbeats, reports the
+  databases it can see, delivers any finished dump, and asks what to do.
+- The **app owns the schedule**. When a dump is due, the check-in reply says so; the agent
+  runs `pg_dump`/`mysqldump`/`mongodump` and **streams the result home chunked** — never
+  buffering the whole dump in memory or on disk.
+- The agent **self-updates**: the app advertises the current script version and the agent
+  swaps its own script atomically (after a compile check). Disable with
+  `BACKHAUL_AUTOUPDATE=0`.
+
+Config pulls, data pushes.
+
+## Run it
+
+```bash
+docker run -d --name backhaul-agent --restart unless-stopped \
+  --network <DB_DOCKER_NETWORK> \
+  -e BACKHAUL_URL=https://backhaul.skui.io \
+  -e BACKHAUL_TOKEN=<token from the backhaul admin> \
+  -e BACKHAUL_TARGETS=postgres:<DB_HOST>:5432:<DB_NAME>:<USER>:<PASS> \
+  git.skui.io/steffen/backhaul-agent:latest
+```
+
+- `--network` must be the **same private Docker network as the database**, so the agent can
+  reach it by service name.
+- `BACKHAUL_TARGETS` is a comma-separated list, each entry
+  `engine:host:port:db:user:pass`. Engines: `postgres`, `mysql`, `mariadb`, `mongo`.
+
+The agent registers each target with the app on its first check-in; tune the dump cadence,
+retention, and restore-drill schedule from the backhaul dashboard.
+
+## What's in the image
+
+Debian slim + Python 3 (stdlib only — the agent has no Python dependencies) +
+`postgresql-client-17` (pg_dump 17, required to dump Postgres 17 servers) +
+`default-mysql-client`. MongoDB tools are added in a follow-up.
+
+## Logs
+
+```bash
+docker logs -f backhaul-agent          # check-in activity
+```