R-1342: a restore copy under the stable-start watch is not deletable (D62 gap); an app removed during the watch raises no alarm — tests red first; commit only

controller/internal/backup/backup.go

@@ -340,6 +340,9 @@ type Manager struct {
 	// R-550: persistence of the above (restore_record.go) and the per-app interrupted notices.
 	opRecordPath  string
 	opInterrupted map[string]RestoreOpResult
+	// R-1342: the restore copies a stable-start watch still holds (copy dir → true), guarded by mu. While one is here the
+	// copy is the way back if the restored app turns out unstable: „Törlés most" refuses it (restore_copies.go).
+	watching map[string]bool
 	// R-519: the app-data run record (run_record.go) and the start of the last run a stop cut off (zero = none).
 	runRecordPath  string
 	runInterrupted time.Time