controller v0.241.0: a bind-data app leans on off-site before its own unit; the hold names what the copy holds (R-479)

Operator ruling 2026-09-13. An app with classified binds walks second
drive -> off-site -> own unit (its unit holds no files); volume apps keep
2 -> 1 -> 3. RestoreHold.CopyHolds records what the chosen copy holds and
the sentence ends with it; older holds keep their tier-only sentence.
Tests on both halves; red-proof: a layout-blind order fails the bind case.

controller/internal/backup/offbox_reconstitute.go

@@ -346,7 +346,10 @@ func (m *Manager) RestoreHoldFor(stack string) (bool, string) {
 		}
 		// R-475: name the tier when the hold recorded one; an older hold keeps its own sentence.
 		if label := UpdateTierLabel(h.CopyTier); label != "" && h.CopyDate != "" {
-			return true, fmt.Sprintf(UpdateHoldFmt, stack, fmtHoldTime(h.At), label, copyDate)
+			if h.CopyHolds != "" { // R-479: name what the copy holds
+				return true, fmt.Sprintf(UpdateHoldFmt, stack, fmtHoldTime(h.At), label, copyDate, h.CopyHolds)
+			}
+			return true, fmt.Sprintf(UpdateHoldTierFmt, stack, fmtHoldTime(h.At), label, copyDate)
 		}
 		return true, fmt.Sprintf(UpdateHoldLegacyFmt, stack, fmtHoldTime(h.At), copyDate)
 	}