R-645: the night backup skips an app whose pinned version is not the one it runs (09 decision 142)

Every night leg (DB dump, volume dump, recovery-unit capture, Tier-2 mirror) now leaves alone an app
whose app.yaml pin (pinned_images) differs from its running record (installed_images) - the state a
failed update leaves behind. A hold lifted by hand (--clear-restore-hold + restart) no longer lets the
capture write the just-failed definition over the good unit. Unknown (no pin, no record, a service not
observed) never skips. The log says it per leg; the backups page shows one amber line, hu + en
(backup.status.version_skip). Seam: backup.Manager.SetVersionCheck <- stacks.Manager.PinNotRunning.

Tests: TestR645_HandLiftedHoldKeepsTheGoodUnit (whole night run + Tier 2, unit tree fingerprint),
TestR645_VersionSkipSentence, TestR645_PinNotRunning_*, TestR645_BackupRowSaysTheNightBackupSkipsIt,
TestR645_VersionCheckIsWiredAtStartup.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -1638,6 +1638,12 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus, lang string
 		// the customer's data may not be intact. Measured 2026-08-22: after a failed MariaDB replay
 		// the app reported `health=healthy, running=true, restarts=0` while its schema-version table
 		// held zero rows.
+		// R-645 (09 §3 decision 142): an app the night backup leaves alone because it is not running its
+		// pinned version says so — amber, a deviation, not a failure. Before the hold check, which wins.
+		if skip, why := s.backupMgr.VersionSkipFor(app.StackName, lang); skip {
+			row.Status = "yellow"
+			row.StatusText = why
+		}
 		if held, why := s.backupMgr.RestoreHoldForLang(app.StackName, lang); held {
 			row.Status = "red"
 			row.StatusText = why