controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/update_events_wiring_test.go

@@ -1,6 +1,10 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"strings"
+	"testing"
+)
 
 // v0.264.0. The update-event sink and the R-646 backfill are both CALLED from main.go (an AST walk —
 // a comment naming them would not count). A sink built and never wired would fail silently: no event,
@@ -21,3 +25,16 @@ func TestUpdateEventSinkIsWiredAtStartup(t *testing.T) {
 		t.Error("BackfillAppliedMeta (R-646) must be called, after AdoptPins")
 	}
 }
+
+// R-647 (2) — the held event carries the copy_holds KEY, never the Hungarian phrase: the hub prints the
+// raw details as the household mail's `Note:` line. COMPANION RED-PROOF (REPORT.md): wire
+// UpdateCopyHolds back — this fails.
+func TestR647_HeldEventCarriesTheCopyHoldsKey(t *testing.T) {
+	src, err := os.ReadFile("main.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(src), "d.CopyHolds = backupMgr.UpdateCopyHoldsKey(") {
+		t.Fatal("main.go must fill AppUpdateDetails.CopyHolds with UpdateCopyHoldsKey (the key), not the Hungarian phrase")
+	}
+}