R-203 Part 2: a run that missed a MANDATORY directory is not a successful run (v0.197.0)

The gap was already detected and warned about, in Hungarian, naming the app and the folders --
that warning is what stopped the R-201 drill. The defect was that the run still reported `ok`
beside it, and a warning standing beside a success is read as a success.

last_status gains "incomplete": minted, because "ok" | "error" | "running" had nothing meaning
"it ran, and this app is not fully protected". NOT "error" -- the rest of the run worked and
what was captured is real, so SnapshotCount and the LastSuccess anchor still record it. Half a
backup is not no backup.

The gaps are now recorded STRUCTURALLY (offboxRunResult.mandatoryGaps), not only as prose, so
the verdict has something to act on. It reaches the operator through the EXISTING per-run digest
(backup_run_failures) rather than a new event type -- a new type is a two-repo change and the
hub drops anything outside allowedEventTypes.

The stat-filter gains the ClassMandatory check Tier 2 already had. It is a NO-OP today
(TierOffsite admits mandatory only), so no customer-visible warning disappears -- demonstrated
by widening the tier filter alone and watching the check hold the line.

ANTICIPATED: calibre-web on demo-hp has exactly this gap, so its off-site status becomes
incomplete the moment this ships. That is correct and is the point.

Red-proofs: my first Scenario-C proof PASSED because the test only reached offboxCaptureSet
while the mutation lives in runOffboxInternal -- a mutation the test cannot observe is not a
red-proof, and the fix was the test. The run-level test now fails under both mutations
(unreachable gap recording; unconditional ok).

controller/internal/settings/settings.go

@@ -162,7 +162,11 @@ type OffboxTarget struct {
 
 	// Runtime status (written by the off-box runner; never holds a secret).
 	LastRun    string `json:"last_run,omitempty"`    // RFC3339
-	LastStatus string `json:"last_status,omitempty"` // "ok" | "error" | "running"
+	// LastStatus — "ok" | "incomplete" | "error" | "running". R-203 added "incomplete": the run
+	// completed and what it captured is real, but a directory the app declares MANDATORY could not be
+	// captured, so the app is NOT fully protected. Distinct from "error" (the run failed) on purpose;
+	// SnapshotCount and LastSuccess still record what WAS captured.
+	LastStatus string `json:"last_status,omitempty"`
 	// LastSuccess (R-100) is the RFC3339 stamp of the last run that actually SUCCEEDED.
 	//
 	// IT EXISTS BECAUSE LastRun RECORDS AN ATTEMPT, NOT A RESULT. LastRun is written