v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -1776,6 +1776,13 @@ func main() {
 			if notifier != nil {
 				notifier.NotifyAppDeployed(name, display)
 			}
+			// v0.283.0 (decision 50, R-720): a FRESH install on a box whose customer has off-site is in the
+			// off-site copy by default. An app with an earlier backup choice keeps it (settings rule).
+			if on, why := sett.DefaultOffboxOnForNewApp(name); on {
+				log.Printf("[INFO] [backup] %s: off-site copy switched ON at install (decision 50)", name)
+			} else {
+				log.Printf("[DEBUG] [backup] %s: off-site default not applied: %s", name, why)
+			}
 			// v0.279.0 (decision 45): a FRESH install replaces a known default login with its generated one,
 			// when the template declares after_install. Never on a restore or a kept-data load — those do not
 			// pass through the deploy-done hook.