controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/notify/update_events_test.go

@@ -102,3 +102,15 @@ func TestR620_DisabledNotifierSaysWhatItDrops(t *testing.T) {
 		}
 	}
 }
+
+// R-647 (3) — the disabled path names the SEVERITY a health change would be sent at, never the health
+// status. COMPANION RED-PROOF (REPORT.md): pass `status` again — the line reads "severity warn".
+func TestR647_DisabledHealthChangeNamesTheSeverity(t *testing.T) {
+	var buf bytes.Buffer
+	n := New("", "", "c1", nil, log.New(&buf, "", 0), false)
+	buf.Reset()
+	n.NotifyHealthChange("warn", nil, nil)
+	if !strings.Contains(buf.String(), "DROPPED event health_change (severity warning)") {
+		t.Fatalf("want the severity 'warning' named, got:\n%s", buf.String())
+	}
+}