R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/cmd/controller/r1256_sweep_wiring_test.go

@@ -0,0 +1,13 @@
+package main
+
+import "testing"
+
+// TestR1256_H8_TheSweepIsWiredAtStartup — R-1256 H8: an unused restore copy goes only through
+// SweepUnusedRestoreCopies, so main.go must CALL it (the seam-built-but-never-wired class).
+// RED-PROOF: delete the `restore-copy-sweep` job — this fails.
+func TestR1256_H8_TheSweepIsWiredAtStartup(t *testing.T) {
+	lines, _, _ := slice4CallLines(t)
+	if len(lines["SweepUnusedRestoreCopies"]) == 0 {
+		t.Fatal("SweepUnusedRestoreCopies is never called — an unused restore copy would stay on the drive for ever")
+	}
+}