controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,29 @@
+## v0.265.0 — the cause of "runs but not installed", a held app that says so, a louder OOM storm (2026-09-23, R-634, R-625, R-636, R-647)
+
+**MinAgent: 0.131.0** (unchanged). **Needs hub v0.121.0** (deployed first). New strings: yes (hu + en).
+
+- **R-634 — the mechanism, diagnosed and fixed.** Reproduced on 9202: deploy `outline`, press the
+  whole-box backup 20 s later. The backup's list read the in-memory `Deployed` flag, which is true from
+  the moment a deploy is ACCEPTED, so the volume leg stopped the deploying app (`compose down`), dumped its
+  half-made volumes and ran a SECOND `compose up -d` beside the deploy's own; both failed and the deploy
+  recorded „not deployed" (on 2026-09-22 the backup's `up` won and the containers ran under it). Fix:
+  `ListDeployedStacks` leaves out a deploying app; the volume leg asks again right before the stop (SKIP,
+  never a failure); `StopStack` / `StartStack` refuse a deploying stack for every caller
+  (`ErrStackDeploying`). `sparkyfitness` did not reproduce alone (deployed in 47 s).
+- **R-625 — a held app shows the truth.** The update badge of a held app reads „Megállítva —
+  visszaállítás szükséges" / "Stopped — restore needed" (`tag-error`, title = the hold's first sentence
+  in the reader's language). No Update button (the list already hid it; now pinned). Parity fixtures
+  `app_info_deployed` and `stacks_full` regenerated — measured diff: exactly the new badge, one line each.
+- **R-636 — a repeating OOM problem gets louder.** The scan reads the kernel's `oom_kill` counter,
+  `memory.max` and `memory.peak` for flagged containers; 20+ kills in 30 min of the same container run →
+  ONE `app_oom_storm` (error, operator-only). `app_oom` unchanged. RomM's measured rate was ≈375 kills /
+  30 min; one hiccup is 1–3.
+- **R-647 — the three leftovers.** A held update's error is the key `update.error.held`, rendered per
+  reader (page funcs now apply to Hungarian too; same bytes on a Hungarian box); the `app_update_held`
+  details carry the `copy_holds` KEY, not the Hungarian phrase; the undone event no longer logs
+  `hold recorded`, and the disabled-notifier line names the real severity of a health change.
+- Red-proofs: eight in this repo, each seen failing (REPORT).
+
 ## v0.264.0 — the undo reaches the fleet, and the household is TOLD, in its own language (2026-09-23, `09` §6.4 parts 2–3)
 
 **MinAgent: 0.131.0** (unchanged). **Needs hub v0.120.0** (deployed first). New strings: yes (hu + en).