R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/web/kept_copies.go

@@ -106,7 +106,10 @@ func (s *Server) keptUnitRestoreHandler(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	s.logger.Printf("[WARN] [web] Restore of %s from a set-aside unit requested (async): %s from %s", k.Source, k.Path, r.RemoteAddr)
-	s.backupMgr.BeginRestoreOp("restore", k.Source)
+	if msg, ok := s.beginRestoreOp("restore", k.Source); !ok {
+		http.Redirect(w, r, "/backups/restore?flash_error="+url.QueryEscape(msg), http.StatusFound)
+		return
+	}
 	go func() {
 		app, res, err := s.backupMgr.RestoreSetAsideUnit(id)
 		if err != nil {