Glad you have a solution. Here are a couple things that will make it easier for someone else.
If you use DISCOURSE_ALLOW_RESTORE: 'true' in your app.yml, you can skip enabling restore. (You can similarly put your Google auth in ENV and keep them out of the database altogether.)
If you have both staging and production use the same S3 bucket, you can restore the latest backup with
docker exec ${CONTAINER_NAME} bash -c '$(discourse restore|grep gz|head -1)'
If you need to read it locally, you could similarly override the sitesetting with an ENV and it would read the most recent backup from the local store.