controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/update_guard.go

@@ -152,6 +152,13 @@ func (m *Manager) UpdateCopyHolds(stackName string, tier int) string {
 	return util.Text(i18n.Default, updateCopyHoldsKey(m.DataOutsideUnit(stackName), tier))
 }
 
+// UpdateCopyHoldsKey is the same verdict as UpdateCopyHolds, as its bundle KEY (R-647, v0.265.0). The
+// app_update_held event carries the key, not the Hungarian phrase: the hub prints the raw details as
+// the mail's `Note:` line, and an English household read „a beállításokat, …" there.
+func (m *Manager) UpdateCopyHoldsKey(stackName string, tier int) string {
+	return updateCopyHoldsKey(m.DataOutsideUnit(stackName), tier)
+}
+
 func updateCopyHoldsKey(outside bool, tier int) string {
 	switch tier {
 	case UpdateTierLocal: