DataProtection restore silently falls back to the first pod port #10615

When a restore post-ready Job specifies BackupTarget.ContainerPort and that named port is missing, restoreJobBuilder falls back to the first pod port. This can connect the restore action to an unrelated endpoint instead of surfacing the invalid target configuration.

Expected behavior: propagate the named-port lookup error and do not build the restore Job. A connection credential PortKey remains authoritative when explicitly configured.