v0.275.0: a backup's data and its version travel together (R-696, 07 §6.6, D4 option A); R-695, R-691, R-694

The unit's data files are stamped with the versions that wrote them; the capture keeps the
definition the data belongs to; a restore never starts data under another version's
definition (unit restores refuse a mismatch; the off-site restore writes the snapshot's
definition); every tier's time is its data's; the conversion-copy release needs a dump on
the new engine. File-browser sync single-flight + no empty kept folder (R-695); the kept
view joins the folder's owning group, language switch resyncs (R-691); a restore-generated
login is not shown as the password (R-694). Red-proofs in
felhom.eu/documentation/audits/version-travel-2026-09-26/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/slice4_update_guard_test.go

@@ -148,7 +148,7 @@ func TestSlice4_NightlyLegsLeaveAHeldAppAlone(t *testing.T) {
 	if len(h.volDumped) != 1 || h.volDumped[0] != "free" {
 		t.Errorf("positive control: the unheld app must still be dumped, got %v", h.volDumped)
 	}
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 	for _, n := range h.prov.infoHits {
 		if n == "held" {
 			t.Error("the capture must not rewrite a HELD app's restore point")
@@ -178,7 +178,7 @@ func TestSlice4_NightlyLegsLeaveAnAppMidUpdateAlone(t *testing.T) {
 	h.m.settings = slice4Settings(t)
 	h.m.SetUpdatingCheck(func(name string) bool { return name == "updating" })
 	h.m.runVolumeDumps()
-	h.m.captureAllRecoveryUnits()
+	h.m.captureAllRecoveryUnits(false)
 	var mirrored []string
 	h.m.perAppTier2 = func(name string) error { mirrored = append(mirrored, name); return nil }
 	h.m.RunAllTier2()