R-304 option C: operator mail when a household's code opens or may open an older package (once a day); R-298 side fix (no eject/format on a backup-target drive); R-717 comments

Unreleased; ships with tomorrow's release (needs the hub of the same day).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/after_setup.go

@@ -30,7 +30,8 @@ import (
 //
 // A command form (`service`, `command`, `success`, `env` names) follows after_install's argv-safe rules (R-713).
 //
-// R-717: an app whose switch lives in its own database (opengist, wishlist) is closed by `command` and reopened for
+// R-717: an app whose switch lives in its own database (today: wishlist; opengist is closed by its signup_block,
+// signup_block.go) is closed by `command` and reopened for
 // the household's window by its twin:
 //
 //	after_setup: