R-645: the night backup skips an app whose pinned version is not the one it runs (09 decision 142)

Every night leg (DB dump, volume dump, recovery-unit capture, Tier-2 mirror) now leaves alone an app
whose app.yaml pin (pinned_images) differs from its running record (installed_images) - the state a
failed update leaves behind. A hold lifted by hand (--clear-restore-hold + restart) no longer lets the
capture write the just-failed definition over the good unit. Unknown (no pin, no record, a service not
observed) never skips. The log says it per leg; the backups page shows one amber line, hu + en
(backup.status.version_skip). Seam: backup.Manager.SetVersionCheck <- stacks.Manager.PinNotRunning.

Tests: TestR645_HandLiftedHoldKeepsTheGoodUnit (whole night run + Tier 2, unit tree fingerprint),
TestR645_VersionSkipSentence, TestR645_PinNotRunning_*, TestR645_BackupRowSaysTheNightBackupSkipsIt,
TestR645_VersionCheckIsWiredAtStartup.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -600,6 +600,8 @@ func main() {
 	// updated, not only once it is held — found live in Scenario F, see backup.Manager.isHeld.
 	if backupMgr != nil {
 		backupMgr.SetUpdatingCheck(stackMgr.IsUpdating)
+		// R-645 (09 §3 decision 142): the night backup leaves an app that is not running its pinned version alone.
+		backupMgr.SetVersionCheck(stackMgr.PinNotRunning)
 		// R-671 (v0.272.0): a restore that lifts an update hold removes the undo copies that hold kept.
 		backupMgr.SetUndoCopyRemover(stackMgr.RemoveUndoCopies)
 	}