v0.238.1: the nightly backup leaves an app alone WHILE it is being updated, not only once it is held (slice 4 follow-up)

Found live in v0.238.0 Scenario F on demo-hp: during an update's 5-minute health wait the app is not
yet held, and the periodic recovery-unit capture at 10:17:09 wrote the never-started definition
(alpine:3.20) into its PRIMARY unit, 53 s before the hold landed. The Tier-2 mirror the hold names
survived only because Tier 2 runs daily; a nightly Tier 2 inside a verify window would have mirrored
the broken definition over the copy the customer is told to restore from.

backup.Manager.isHeld — consulted by the capture sweep, the Tier-2 run and the volume dump — is now
also true while a guarded update is moving the app, via SetUpdatingCheck wired in main.go to
stacks.Manager.IsUpdating. Test with positive control + red-proof; wiring pinned.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/update_guard.go

@@ -295,10 +295,29 @@ func (m *Manager) HoldAfterFailedUpdate(stackName string, at time.Time, copyDate
 	return nil
 }
 
-// isHeld reports whether an app carries ANY hold. Used by the nightly legs to leave a held app alone.
+// isHeld reports whether the nightly legs must leave an app alone: it carries ANY hold, OR a guarded
+// update is moving it right now.
+//
+// THE SECOND HALF WAS FOUND LIVE, v0.238.0 Scenario F on demo-hp 2026-09-13. During the update's
+// 5-minute health wait the app is not yet held, and the periodic capture ran at 10:17:09 and wrote
+// the NEW definition (alpine:3.20, which never started) into the app's PRIMARY unit, 53 s before the
+// hold landed at 10:18:02. The Tier-2 mirror the hold names was intact only because the Tier-2 run is
+// daily — a nightly Tier-2 falling inside a verify window would have mirrored the broken definition
+// over the very copy the customer is told to restore from. An app mid-update has a restore point that
+// must not move, exactly like a held one.
 func (m *Manager) isHeld(stackName string) bool {
 	held, _ := m.RestoreHoldFor(stackName)
-	return held
+	if held {
+		return true
+	}
+	return m.updatingCheck != nil && m.updatingCheck(stackName)
+}
+
+// SetUpdatingCheck wires the "is a guarded update moving this app" question (stacks.Manager.IsUpdating).
+// INIT-ONLY, in main.go — pinned by TestSlice4_UpdatingCheckIsWiredAtStartup. The backup package cannot
+// import stacks, which is why it is a seam.
+func (m *Manager) SetUpdatingCheck(fn func(stackName string) bool) {
+	m.updatingCheck = fn
 }
 
 // clearUpdateHoldAfterRestore lifts an UPDATE hold once a person has restored the app successfully.