Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

tier2_capture.go: classified apps get TierSecondary per-bind legs (paperless copy shrinks — export
drops); legacy apps keep the byte-identical resolver set. v2 relpath-mirroring layout
(backups/secondary/<stack>/{marker LAST, recovery-unit/, hdd/<rel>/, userdata/<rel>/}); N>1 native
(errTier2MultiDir/tier2AppDataName deleted). Migration=delete-and-rebuild + reconcile; all RemoveAll
via tier2SafeRemove (refuses outside backups/secondary/). SSD=state-only tier. selectTier2Target
never picks network storage (pinned+auto, F-6C-1). Restore reads v2 behind a marker gate.
Part 0: offbox_enlarge_blocked is a persisted one-time Load seed (opt-out sticks), not a getter
append. Part 0.5: offsite restore scratch prefers a local (non-network) path.
Full v2 test suite + all 10 §10 red-proofs verified. Destructive writes bounded to backups/secondary/.

controller/internal/backup/tier2_test.go

@@ -38,7 +38,7 @@ func TestSelectTier2Target_HonorsPreferred(t *testing.T) {
 	if err := sett.SetTier2Preference("app", false, "/mnt/b"); err != nil {
 		t.Fatal(err)
 	}
-	target, err := m.selectTier2Target("app", 1024)
+	target, err := m.selectTier2Target("app", 1024, 1024)
 	if err != nil {
 		t.Fatalf("selectTier2Target: %v", err)
 	}
@@ -59,7 +59,7 @@ func TestSelectTier2Target_InvalidPreferredFallsBack(t *testing.T) {
 	if err := sett.SetTier2Preference("app", false, "/mnt/gone"); err != nil {
 		t.Fatal(err)
 	}
-	target, err := m.selectTier2Target("app", 1024)
+	target, err := m.selectTier2Target("app", 1024, 1024)
 	if err != nil {
 		t.Fatalf("selectTier2Target: %v", err)
 	}