v0.263.0: a failed update puts the app back by itself (09 decision 15, R-637)

The guarded update gains a folder copy of the app's named volumes, taken
after the pull where the app stops anyway (decision 19, chosen by the
2026-09-23 bake-off). On a failed health check the box undoes: every copy
validated by its finished-marker first, volumes refilled, definition and pin
from the job's own pre-update copies, the old version checked with the OLD
.felhom.yml probe. It holds only if the undo fails, and the hold sentence
says so and what state the data is in. Bind-mounted folders are never
touched.

- R-637 built; R-638/R-640/R-641 do not arise with a folder copy; R-639
  (pre-update copies incl. .felhom.yml kept until the undo is over).
- journal phases copying/undoing with power-cut recovery.
- app.yaml last_update_undone + one line on the app page (hu/en).
- R-642: start/restart never answer "completed".
- Removal deletes kept undo copies.

MinAgent unchanged (0.131.0). Nine red-proofs in REPORT.md.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/manager.go

@@ -235,14 +235,18 @@ type Manager struct {
 	execFn func(name string, args ...string) (string, error)
 
 	// --- guarded update (slice 4, update.go) ---
-	updateGuards     UpdateGuards // init-only, SetUpdateGuards; nil ⇒ every update is REFUSED
-	updateComposeFn  func(dir string, env []string, args ...string) (string, error)
-	updateHealthFn   func(ctx context.Context, name string, timeout time.Duration) (bool, string)
-	updateMemoryFn   func(newReqMB, newLimitMB, releasedReqMB, releasedLimitMB int) (refusal error, warning string)
-	updateDiskFreeFn func() (freeGiB float64, ok bool)
-	updateNowFn      func() time.Time
-	updateJournalMu  sync.Mutex
-	updateResume     []string // apps whose update was interrupted after `up`; resumed once guards exist
+	updateGuards    UpdateGuards // init-only, SetUpdateGuards; nil ⇒ every update is REFUSED
+	updateComposeFn func(dir string, env []string, args ...string) (string, error)
+	updateHealthFn  func(ctx context.Context, name string, timeout time.Duration) (bool, string)
+	// v0.263.0 undo seams (undo.go): the volume copier (nil ⇒ docker) and the undo's health wait,
+	// which receives the probe it must use (nil ⇒ waitUpdateHealthyMeta).
+	undoCopier         volumeCopier
+	updateUndoHealthFn func(ctx context.Context, name string, timeout time.Duration, meta *Metadata) (bool, string)
+	updateMemoryFn     func(newReqMB, newLimitMB, releasedReqMB, releasedLimitMB int) (refusal error, warning string)
+	updateDiskFreeFn   func() (freeGiB float64, ok bool)
+	updateNowFn        func() time.Time
+	updateJournalMu    sync.Mutex
+	updateResume       []string // apps whose update was interrupted after `up`; resumed once guards exist
 	// inspectRestartPolicyFn is the docker-inspect seam for the above; nil in production
 	// (dockerRestartPolicy). Tests inject a scripted lookup and never touch docker.
 	inspectRestartPolicyFn func(containerName string) (string, error)