Revert "Revert "Ensure install-during-restore is like install-then-restore""

This reverts commit 9e05af28a9a66f1bbf56e74b98a7ec360a7daf3d.
Revert "Revert "Validate restored file paths against their nominal domain""

This reverts commit 5663fad7e9a6b9ed137e5b8a3baf6df4832aeb36.