v0.147.3 — 4c follow-up 3: the run does not end with the last app

Third real run, third thing only a live run could show. The per-app legs
finished in ~15 seconds; the remaining 40 of the 57-second run was the shares leg
and forget --prune, during which the card sat frozen on "calibre-web — 8 / 8
fájl". The same frozen-looking silence 4c exists to remove, relocated to the end.

Progress now carries a phase. The post-app stages announce themselves and the
app-scoped counters are cleared when a phase starts, so the last app's finished
numbers are never shown against work that is no longer about that app. Starting
the next app clears the phase again. Pinned by a test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

controller/internal/backup/offbox.go

@@ -55,7 +55,9 @@ func (m *Manager) SetOffboxNotify(fn func(dur time.Duration, snapshots int, err
 }
 
 // SetOffboxOrphanEvent wires the offsite-repo continuity event push (main.go → notifier).
-func (m *Manager) SetOffboxOrphanEvent(fn func(eventType, renamedTo string)) { m.offboxOrphanEvent = fn }
+func (m *Manager) SetOffboxOrphanEvent(fn func(eventType, renamedTo string)) {
+	m.offboxOrphanEvent = fn
+}
 
 // SetOffboxSSH overrides the raw-ssh exec used for the orphaned-repo move-aside (tests).
 func (m *Manager) SetOffboxSSH(fn func(ctx context.Context, host, user string, port int, keyPath, knownHosts, remoteCmd string) ([]byte, error)) {
@@ -217,7 +219,9 @@ func (m *Manager) SetOffboxSizer(fn func(path string) int64) { m.offboxSizer = f
 func (m *Manager) SetOffboxEnlargeBlockedNotifier(fn func(stack string, estBytes int64, usedGB, quotaGB int)) {
 	m.offboxEnlargeBlockedNotify = fn
 }
-func (m *Manager) SetOffboxPlaceCopier(fn func(src, dst string) (int, error)) { m.offboxPlaceCopier = fn }
+func (m *Manager) SetOffboxPlaceCopier(fn func(src, dst string) (int, error)) {
+	m.offboxPlaceCopier = fn
+}
 
 // offboxSize returns the mandatory-set byte estimator (nil seam → the real du -sb dirSizeBytes).
 func (m *Manager) offboxSize() func(string) int64 {
@@ -923,6 +927,7 @@ func (m *Manager) runOffboxInternal(ctx context.Context, apps, base, env []strin
 	// R-7b: the SHARES leg runs AFTER the per-app loop and BEFORE retention, so `forget --group-by
 	// host,tags` covers the `_shares` group for free. It is placed BEFORE the firstErr return on
 	// purpose: share protection must not be dropped because some unrelated app failed to push.
+	m.offboxProgress.setPhase(OffboxPhaseShares)
 	sharesRes, sharesErr := m.runOffboxSharesLeg(ctx, base, env, t)
 	m.recordSharesOffsiteStatus(sharesRes)
 	res.warns = append(res.warns, sharesRes.warns...)
@@ -942,6 +947,7 @@ func (m *Manager) runOffboxInternal(ctx context.Context, apps, base, env []strin
 	// unit-only-shape snapshots share a group with its NEW enlarged shape (same <stack> tag) and age
 	// out naturally — the default host,paths grouping would strand old-shape snapshots in their own
 	// permanently-retained group. prune takes an EXCLUSIVE lock (the C2 stale-lock step) → resticStep.
+	m.offboxProgress.setPhase(OffboxPhaseRetention)
 	fctx, cancel := context.WithTimeout(ctx, offboxBackupTimeout)
 	defer cancel()
 	if out, ferr := m.resticStep(fctx, env, base, "prune", "forget", "--group-by", "host,tags", "--keep-daily", "7", "--keep-weekly", "4", "--keep-monthly", "6", "--prune"); ferr != nil {