controller v0.241.0: a bind-data app leans on off-site before its own unit; the hold names what the copy holds (R-479)

Operator ruling 2026-09-13. An app with classified binds walks second
drive -> off-site -> own unit (its unit holds no files); volume apps keep
2 -> 1 -> 3. RestoreHold.CopyHolds records what the chosen copy holds and
the sentence ends with it; older holds keep their tier-only sentence.
Tests on both halves; red-proof: a layout-blind order fails the bind case.

controller/internal/backup/update_tiers_test.go

@@ -178,7 +178,7 @@ func TestR475_HoldTextNamesTheTier(t *testing.T) {
 			t.Fatal(err)
 		}
 		held, why := m.RestoreHoldFor("gokapi")
-		want := fmt.Sprintf(UpdateHoldFmt, "gokapi", "2026-09-13 10:00", label, "2026-09-13 03:30")
+		want := fmt.Sprintf(UpdateHoldTierFmt, "gokapi", "2026-09-13 10:00", label, "2026-09-13 03:30")
 		if !held || why != want {
 			t.Errorf("tier %d: hold text =\n%q\nwant\n%q", tier, why, want)
 		}