feat(control): add pod restore calls

protect/control/v1/control.proto

@@ -34,6 +34,9 @@ service ControlService {
   rpc ForkZone(ForkZoneRequest) returns (ForkZoneReply);
   rpc ExportZone(ExportZoneRequest) returns (stream ExportZoneReply);
   rpc ImportZone(stream ImportZoneRequest) returns (ImportZoneReply);
+  rpc ClaimRestoredZone(ClaimRestoredZoneRequest) returns (ClaimRestoredZoneReply);
+  rpc StartRestoredZone(StartRestoredZoneRequest) returns (StartRestoredZoneReply);
+  rpc AdoptWorkload(AdoptWorkloadRequest) returns (AdoptWorkloadReply);
 
   rpc ResolveZoneId(ResolveZoneIdRequest) returns (ResolveZoneIdReply);
   rpc ResolveZoneIds(ResolveZoneIdsRequest) returns (ResolveZoneIdsReply);
@@ -220,12 +223,101 @@ message ImportZoneStart {
   // Import under this zone id instead of a freshly allocated one. Empty
   // allocates a new id, which is what lets one snapshot seed many zones.
   string zone_id = 2;
+  // Hold the imported zone, paused and with its host mounts unbound, for a
+  // runtime that claims it with the same `claim`.
+  RestoreClaim restore = 4;
 }
 
 message ImportZoneReply {
   string zone_id = 1;
 }
 
+// What an imported zone is held for. The zone waits, paused, until a runtime
+// presents the same `claim`, so a runtime can only claim a zone that was
+// imported for it. The daemon compares the string and nothing more.
+message RestoreClaim {
+  string claim = 1;
+  // Kept with the zone and returned when it is claimed. The daemon does not
+  // read them.
+  repeated AnnotationSpec annotations = 2;
+}
+
+// Claims the zone imported for `claim`. Waits, up to the daemon's claim
+// timeout, for the import to exist. A zone can be claimed once.
+message ClaimRestoredZoneRequest {
+  string claim = 1;
+}
+
+message ClaimRestoredZoneReply {
+  string zone_id = 1;
+  repeated RestoredWorkload workloads = 2;
+  // The annotations the import was given.
+  repeated AnnotationSpec annotations = 3;
+}
+
+// A workload the restored zone was running, as the snapshot recorded it.
+message RestoredWorkload {
+  string workload_id = 1;
+  string image = 2;
+  repeated AnnotationSpec annotations = 3;
+  repeated RestoredMount mounts = 4;
+}
+
+// A host mount of a restored workload. `recorded_host_path` names a path on the
+// host that took the snapshot and is only a hint: the daemon never binds it.
+message RestoredMount {
+  string target_path = 1;
+  bool read_only = 2;
+  string recorded_host_path = 3;
+}
+
+// What a mount that has no host path yet is bound to until a container
+// supplies it.
+enum RestoredPlaceholder {
+  RESTORED_PLACEHOLDER_UNSPECIFIED = 0;
+  RESTORED_PLACEHOLDER_FILE = 1;
+  RESTORED_PLACEHOLDER_DIRECTORY = 2;
+}
+
+// Where one mount of a restored workload is bound before its zone resumes.
+message RestoredBinding {
+  string workload_id = 1;
+  string target_path = 2;
+  // The host path to bind. The daemon resolves it and refuses one outside its
+  // configured restore bind roots. Empty binds `placeholder` instead.
+  string host_path = 3;
+  RestoredPlaceholder placeholder = 4;
+}
+
+// Binds every mount of a claimed zone, then resumes it. Each mount of each
+// running workload needs exactly one binding. `annotations` are set on the
+// zone's spec, replacing any with the same key.
+message StartRestoredZoneRequest {
+  string zone_id = 1;
+  repeated RestoredBinding bindings = 2;
+  repeated AnnotationSpec annotations = 3;
+}
+
+message StartRestoredZoneReply {}
+
+// Binds a restored workload to the container a runtime created for it.
+// `mounts` are the container's own mounts: each of the workload's recorded
+// mounts must have exactly one with the same target path and read-only flag,
+// and no other mount may be left over. A mount whose resolved host path differs
+// from the one it is bound to is rebound. `annotations` are set on the
+// workload, replacing any with the same key. Repeating the call for the same
+// workload replaces the earlier one.
+message AdoptWorkloadRequest {
+  string zone_id = 1;
+  string workload_id = 2;
+  string container_id = 3;
+  string sandbox_id = 4;
+  repeated MountSpec mounts = 5;
+  repeated AnnotationSpec annotations = 6;
+}
+
+message AdoptWorkloadReply {}
+
 // Resolves zone "friendly name" to a singular zone UUID, if possible. Matching is exact.
 // See also `ResolveZoneIdsRequest` (plural).
 message ResolveZoneIdRequest {