R-403: the restore OUTCOME names the package's date, not the run's

Live on demo-hp the confirm said 11:43 (the preserved package) and the outcome said 14:23 (the
copy's newest run) for the same restore. A customer reading both cannot tell which one they had, and
one of the two is the flattering sentence. Part 2.3's rule is 'not a plain green success ANYWHERE',
and the outcome is an anywhere.

tier2UnitSourceMsg now asks UnitRestoreDate, the same resolver the confirm uses, so the two cannot
disagree. TestR403_OutcomeNamesThePackageDateNotTheRunDate pins it, with a negative control for the
ordinary case.

controller/internal/web/handlers.go

@@ -1724,7 +1724,12 @@ func tier2UnitConfirmWithStaleness(copyDate string, proven bool, stale bool) str
 // date it puts in the confirm — so the sentence the customer approves and the sentence they are left
 // with cannot name different copies.
 func tier2UnitSourceMsg(cov backup.Tier2Coverage) string {
-	date, proven := cov.Tier2CopyDate()
+	// R-403: the OUTCOME names the same date the CONFIRM did — the PACKAGE's, not the copy's newest
+	// run. Live on demo-hp 2026-08-31 these disagreed by two and a half hours (confirm 11:43, outcome
+	// 14:23) after a preserved leg, and a customer reading both would not know which restore they had
+	// just had. §2.3's rule is "not a plain green success ANYWHERE", and the outcome is an anywhere.
+	date, _ := cov.UnitRestoreDate()
+	_, proven := cov.Tier2CopyDate()
 	if date == "" {
 		return ""
 	}