R-893: hold the app after ANY failure once the definition or a volume moved; hold persisted before the stop; run_job done says it ran, not what it found (security review)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/report/opactions_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"reflect"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -140,6 +141,11 @@ func TestOpActions_EachDoorAndItsOutcome(t *testing.T) {
 			t.Errorf("#%d: %+v", id, r)
 		}
 	}
+	// „done" for a job means it ran, never what it found (security review 2026-10-08): the two off-site checks
+	// return nil whatever their verdict, so the message must not read as a pass.
+	if r := resultFor(t, o, 3); !strings.Contains(r.Message, "does not say what it found") {
+		t.Errorf("run_job done message = %q — it must say it does not report the finding", r.Message)
+	}
 	if r := resultFor(t, o, 2); r.Message != "the set-aside history is now deleted on 2026-11-01" {
 		t.Errorf("extend message = %q", r.Message)
 	}