R-356: the off-site restore refused every app that has no data drive

ReconstituteFromOffsite and PlaceOffsiteRestore both resolved the restore
destination with the RAW HDD_PATH and read an empty answer as "the app is not
installed". For 40 of the 53 catalogue apps that answer is correctly empty and
permanent, so both actions refused forever for a running, healthy app — and told
the customer to reinstall it "in the same place", which those apps never offer.

Separate the two questions. "Installed?" is asked of ListDeployedStacks via a new
Manager.isStackDeployed that fails CLOSED on a nil provider. "Where?" is answered
by GetAppDrivePath — the same resolver CaptureRecoveryUnit wrote the snapshot
with, so the restore aims at the place the backup came from.

The 13 drive apps are unchanged: own drive, mismatch check, ack still required.
A third refusal, with its own sentence, covers installed-but-no-resolvable-root.

Fixtures that marked an app "installed" by giving it an HDD path now state
deployment as its own fact. No assertion weakened.

controller/internal/backup/offbox_placement_refusal_test.go

@@ -54,10 +54,13 @@ func TestReconstitute_NotInstalled_RefusalNamesTheRecordedDrive(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// The app is not installed: no live HDD path. This is the rebuilt-machine shape.
+	// The app is not installed: absent from the deployed set. This is the rebuilt-machine shape.
+	// R-356: the HDD path is cleared too (a rebuilt box has neither), but the DEPLOYED set is what
+	// the refusal now consults — an empty HDD path on its own is the normal shape of 40 apps.
+	prov.deployed = map[string]bool{}
 	prov.hdd = map[string]string{}
-	if got := prov.GetStackHDDPath("immich"); got != "" {
-		t.Fatalf("fixture: the app must look uninstalled, got hdd=%q", got)
+	if m.isStackDeployed("immich") {
+		t.Fatal("fixture: the app must look uninstalled")
 	}
 	callsBefore := len(prov.calls)