controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/undo_hold_test.go

@@ -7,6 +7,10 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/i18n"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/util"
 )
 
 // v0.263.0 — a hold after a FAILED UNDO opens with what was tried and what state the data is in, in the
@@ -65,3 +69,15 @@ func TestUndo_HoldSentenceSaysTheUndoWasTriedAndTheDataState(t *testing.T) {
 		t.Errorf("no Hungarian may remain on an English box, got %q", why)
 	}
 }
+
+// R-647 (2) — the key form of the copy verdict is a bundle KEY, the same verdict as the phrase.
+func TestR647_UpdateCopyHoldsKeyIsTheKeyOfThePhrase(t *testing.T) {
+	m := NewManager(&config.Config{}, nil, log.New(io.Discard, "", 0))
+	k := m.UpdateCopyHoldsKey("x", UpdateTierLocal)
+	if !strings.HasPrefix(k, "hold.copy_holds.") {
+		t.Fatalf("want a hold.copy_holds.* key, got %q", k)
+	}
+	if util.Text(i18n.Default, k) != m.UpdateCopyHolds("x", UpdateTierLocal) {
+		t.Fatal("the key must render to exactly the phrase UpdateCopyHolds gives")
+	}
+}