controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_reconstitute_test.go

@@ -82,6 +82,8 @@ COPY public."user" (id, email) FROM stdin;
 		b.WriteString("id-x\tuser@example.invalid\n")
 	}
 	b.WriteString("\\.\n") // the COPY-block terminator
+	// R-640: a real pg_dump ends with its completion marker (and, since 17.6, a \unrestrict line).
+	b.WriteString("\n--\n-- PostgreSQL database dump complete\n--\n\n")
 	return b.String()
 }
 
@@ -303,7 +305,7 @@ func TestReconstituteFlagsCustomerEmptyDump(t *testing.T) {
 // only be honest if this reports the pair's age and warnings before anything is started.
 func TestOffsiteScratchPairReportsWhatTheConfirmNeeds(t *testing.T) {
 	m, _, _ := reconFixture(t, "run1", "2026-07-19T06:00:00Z",
-		"-- PostgreSQL database dump\nCREATE TABLE a();\nCOPY public.\"user\" (id) FROM stdin;\n7\n\\.\n")
+		"-- PostgreSQL database dump\nCREATE TABLE a();\nCOPY public.\"user\" (id) FROM stdin;\n7\n\\.\n"+"-- PostgreSQL database dump complete\n")
 
 	info := m.OffsiteScratchPair("immich")
 	if !info.Ready || !info.HasDump {