B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

internal/stacks/migrate.go: crash-safe, resumable namespace migration over the
controller's /mnt RW mount. Two entry points (whole-namespace + per-app) share one
journaled pipeline: validate -> stop -> copy (rsync -a --checksum, additive; conflict-
merge walk for non-app content) -> verify -> flip+redeploy (RedeployFromEnv) -> cleanup.
CLEANUP (the only destructive step) is gated on all units verified AND all apps
redeployed. Single-flight; mutual exclusion with the backup orchestrator (Change 3).
Non-hollow tests incl. mutation-proven collision + cleanup-gate companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -226,6 +226,13 @@ func main() {
 		backupMgr.SetVersion(Version)
 	}
 
+	// --- Wire the data-migration engine (B1) + backup↔migration mutual exclusion (Change 3) ---
+	stackMgr.SetMigrationDeps(sett, func() bool { return backupMgr != nil && backupMgr.IsRunning() })
+	if backupMgr != nil {
+		backupMgr.SetMigrationRunningCheck(stackMgr.IsMigrating)
+	}
+	stackMgr.RecoverMigration(ctx)
+
 	// --- Initialize alert manager ---
 	alertMgr := web.NewAlertManager(logger)