style: gofmt normalization — no logic changes

gofmt -w across the controller tree (46 files) so gofmt -l is empty — disarms the
formatting landmine where a targeted edit + accidental gofmt -w swept ~46 unrelated
files. Pure formatting: whitespace + gofmt's optional-semicolon removal in reflowed
inline closures. One doc comment reworded ('' -> 'the empty string') to avoid gofmt's
Go-1.19 doc-comment typographic substitition ('' -> curly quote) muddying its meaning.
No build/vet/test behavior change.

controller/internal/backup/recovery_unit.go

@@ -18,10 +18,11 @@ import (
 // RecoveryManifest describes an app's self-contained, SECRET-FREE recovery unit (Phase 2).
 //
 // The unit on a drive is `<nsRoot>/backups/primary/<app>/` and contains:
-//   compose/      docker-compose.yml + .felhom.yml + a SECRET-STRIPPED app.yaml
-//   db-dumps/     app-consistent DB dump(s)        (written by the dump flow)
-//   volume-dumps/ named-volume tars                (written by the dump flow)
-//   manifest.json this file
+//
+//	compose/      docker-compose.yml + .felhom.yml + a SECRET-STRIPPED app.yaml
+//	db-dumps/     app-consistent DB dump(s)        (written by the dump flow)
+//	volume-dumps/ named-volume tars                (written by the dump flow)
+//	manifest.json this file
 //
 // The unit holds NO secret values, NO data-encrypting keys, and NOT the Docker image — only the
 // pinned image tag(s) (re-pulled on restore) and the NAMES of the secret/data-key env vars. The

controller/internal/backup/tier2.go

@@ -187,10 +187,12 @@ func (m *Manager) tier2FitsSystemDrive(sys string, unitSizeBytes int64) bool {
 }
 
 // Tier-2 v2 layout (Task 3b, architecture §8): backups/secondary/<stack>/ holds
-//   .felhom-tier2-layout   (marker file, content "2" — written LAST, after all legs + reconcile)
-//   recovery-unit/         (the unit leg, layout-identical to v1)
-//   hdd/<relpath>/         (per-bind HDD legs, relpath-mirroring)
-//   userdata/<relpath>/    (per-bind USERDATA legs)
+//
+//	.felhom-tier2-layout   (marker file, content "2" — written LAST, after all legs + reconcile)
+//	recovery-unit/         (the unit leg, layout-identical to v1)
+//	hdd/<relpath>/         (per-bind HDD legs, relpath-mirroring)
+//	userdata/<relpath>/    (per-bind USERDATA legs)
+//
 // Relpath-mirroring represents N>1 dirs + nested binds natively (the v1 flat-appdata N>1 refusal is
 // lifted structurally) and makes restore position-derivable (dest relpath → live path under the app's
 // current HDD_PATH). The whole tree is DERIVED from live data — migration is delete-and-rebuild.