The archive's top-level dir is the app's original directory name, and
it was extracted into restore_path's parent: with a custom path the live
dir was moved aside, the files landed under the old name, and the call
still reported success with nothing at restore_path. Extract into a
staging dir, move it into place, and put the live copy back on failure.
