controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/undo.go

@@ -471,7 +471,11 @@ func (m *Manager) emitUpdateEvent(kind, name string, entry *updateJournalEntry,
 	if entry != nil {
 		ev.From, ev.To = entry.PrevPin, entry.NewPin
 	}
-	m.logger.Printf("[INFO] [stacks] update %s: event %s (hold recorded: %v)", name, kind, holdRecorded)
+	if kind == UpdateEventHeld {
+		m.logger.Printf("[INFO] [stacks] update %s: event %s (hold recorded: %v)", name, kind, holdRecorded)
+	} else { // R-647: "hold recorded" means nothing for an undone update
+		m.logger.Printf("[INFO] [stacks] update %s: event %s", name, kind)
+	}
 	sink(ev)
 }