R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/backup/restore_crash_putback.go

@@ -195,9 +195,11 @@ func (p *CrashPutBack) PutBackInterruptedRestore(stack, undoDir string) error {
 	if j.Stack != stack {
 		return fmt.Errorf("the restore copy at %s belongs to %q, not %q", undoDir, j.Stack, stack)
 	}
+	// R-1256 H5: never pour the copy back under an app that could not be stopped — a refusal here is a failed
+	// put-back: the guard holds the app and keeps the copy (R-1251 H2).
 	if p.stop != nil {
 		if err := p.stop(stack); err != nil {
-			p.logger.Printf("[WARN] [appstop] %s: stopping before the put-back failed: %v (continuing)", stack, err)
+			return fmt.Errorf("stopping %s before the put-back: %w", stack, err)
 		}
 	}
 	mgr := &Manager{logger: p.logger, volumeReplayFrom: p.volReplay, undoVolumeRemoveFn: p.volRemove}