v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

New template block after_unclean_boot (decision 236): once per controller start that followed an
UNCLEAN host boot (crashboot's own verdict, after the 15-minute crash grace; a normal or unknown boot
never runs it), each app with the block rebuilds ONLY its zero-byte files (scan: regular files, no
symlinks, its own filesystem; ids appended to the app's own command in batches; one retry, then
reported) and its own lost-file check is read. The household sees lost files (name, date taken) on
the app page until dismissed; the operator gets app_repaired_after_crash with counts only. Skips,
with the reason, an unproven image, an unknown key, an app not running. MinAgent 0.155.0 unchanged.
Tests red-proofed (14 guards). One new parity fixture (the new card only).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/stacks/metadata.go

@@ -71,6 +71,9 @@ type Metadata struct {
 	// (anchored at a segment boundary). See family_gate.go.
 	FamilyGate       bool     `yaml:"family_gate,omitempty" json:"family_gate,omitempty"`
 	FamilyGateExcept []string `yaml:"family_gate_except,omitempty" json:"family_gate_except,omitempty"`
+	// AfterUncleanBoot (R-1007, `09` §3 decision 236): after an unclean host boot, the app rebuilds the files a power
+	// cut left empty, and its own lost-file check is read for the household's note. See after_unclean_boot.go.
+	AfterUncleanBoot *AfterUncleanBootSpec `yaml:"after_unclean_boot,omitempty" json:"after_unclean_boot,omitempty"`
 	// MinController (v0.287.0): the lowest box software that installs this template correctly; a lower one refuses.
 	MinController string           `yaml:"min_controller,omitempty" json:"min_controller,omitempty"`
 	Integrations  []IntegrationDef `yaml:"integrations,omitempty" json:"integrations,omitempty"`