restore

Apply a previously-captured blob. Called from the sigil restore pipeline immediately after the seed is unsealed. The provider decides whether to replace, merge, or skip — the SDK doesn't impose semantics. Errors should be caught and logged inside the implementation: a malformed blob shouldn't fail the whole sigil restore.