restored messages never re-distill

Restored archival messages must always be stored with distilled=1 and must never re-enter distillation. Treating restored content as fresh local input looks consistent, but repeatedly distills or mutates already-processed archival material. Stamp restored_at so pruning uses local residency time rather than the message’s origin time.