SG-1: fix backup of private Castle state during deploy

Existing deploy stopped the container then failed to read mode-0700 state owned by container uid 1000. Read backup through a temporary network-isolated container as the state owner. Keep backup private and restore the existing running container if backup fails. Required to finish the Soroban ID entry rollout.