clear_hold (D64 = B) + the box command through the running controller (R-1343), R-1340, R-1341 — tests red first; commit only

- clear_hold: a fifth verb in the closed operator-action list; lifts a hold of any reason in the RUNNING
  controller (memory + settings.json together), forgets the update's held flag, drops a waiting put-back
  from the app-stop marker (copy kept). Refused on a bad name or no hold. No new event type.
- --clear-restore-hold asks the running controller over <data dir>/ctl/hold.sock (unix, 0600, peer uid
  checked, no TCP); edits settings.json only when no controller answers, and says so (in-guest restart).
- R-1340: the operator's HELD STOPPED mail is built from the hold record (restore kind, mixed cause,
  failed put-back step, database replay or not, kept copy) — never the option-C database story by default.
- R-1341: the OOM WARN line once per new kill (container, start time, kill count); event unchanged.

controller/internal/stacks/update.go

@@ -209,6 +209,25 @@ func (m *Manager) ClearUpdateState(name string) {
 	s.HealthProbe = nil
 }
 
+// ForgetUpdateHeld (D64 = B, R-1343) forgets that the app's last update ended HELD, once the hold itself is cleared
+// by the operator. updateHeld is the ONE held flag kept outside the hold store: it makes the crash-loop observer
+// (ObserveUnhealthy) and the nightly update leg (legCandidate) skip the app, and keeps the hold's sentence as the
+// update error. Left set, an app whose hold was cleared would stay unobserved and never be updated by night until
+// the controller restarts. A running update is not touched. Returns whether anything was forgotten.
+// Pinned by TestD64_ForgetUpdateHeld (this package) and TestD64_ClearHoldForgetsTheUpdateHeldFlag (cmd/controller).
+func (m *Manager) ForgetUpdateHeld(name string) bool {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	s, ok := m.stacks[name]
+	if !ok || s.Updating || (!s.updateHeld && s.UpdateErrorKey != UpdateErrorKeyHeld) {
+		return false
+	}
+	s.updateHeld = false
+	s.UpdatePhase, s.UpdatePhaseLabel = "", ""
+	s.UpdateError, s.UpdateErrorKey, s.UpdateErrorArgs = "", "", nil
+	return true
+}
+
 func (m *Manager) markUpdateHeld(name string) {
 	m.mu.Lock()
 	if s, ok := m.stacks[name]; ok {