R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/backup/restore.go

@@ -224,8 +224,14 @@ func (m *Manager) restoreDockerVolumesFrom(stackName, dumpDir string) (int, erro
 
 		m.logger.Printf("[INFO] [backup] Restoring Docker volume %s for %s", volName, stackName)
 
-		// Remove existing volume (ignore errors — may not exist)
-		dockerexec.Command("docker", "volume", "rm", "-f", volName).Run()
+		// Remove the existing volume. `rm -f` of a missing volume succeeds, so an error means the volume EXISTS and
+		// could not be removed (still in use). R-1256 H5: it used to be ignored — the `volume create` below is a no-op
+		// on an existing volume, and the tar was unpacked ON TOP of the old content (a merge). That volume fails now.
+		if out, err := dockerexec.Command("docker", "volume", "rm", "-f", volName).CombinedOutput(); err != nil {
+			m.logger.Printf("[ERROR] [backup] Failed to remove volume %s before the restore: %s — %v (not written into)", volName, strings.TrimSpace(string(out)), err)
+			failed = append(failed, volName)
+			continue
+		}
 
 		// Create fresh volume — WITH the labels compose gives its own volumes (R-658, v0.268.0). A bare
 		// `volume create` made a volume the update's undo (until v0.267.0) could not find, and one