fix(shares): reserved key leaked into the crossdrive_completed hub event

Found by LIVE VALIDATION, not by a unit test: the first demo tier-2 run pushed
'Masodlagos mentes elkeszult: _shares' — the reserved key reached Hungarian
customer/operator copy.

Mapped at the SOURCE of the notification (RunSharesTier2's tier2Notify calls) so no
future notifier wiring can reintroduce it, plus DisplayStackName at the main.go
wiring as idempotent defense in depth. Regression test added with a red-proof.

controller/internal/backup/tier2_shares.go

@@ -206,7 +206,10 @@ func (m *Manager) RunSharesTier2() error {
 			if err := mirror(sh.Path, filepath.Join(destBase, filepath.FromSlash(rel))); err != nil {
 				m.recordTier2Failure(SharesPseudoStack, target, err)
 				if m.tier2Notify != nil {
-					m.tier2Notify(SharesPseudoStack, target.Label, time.Since(start), err)
+					// DISPLAY BOUNDARY: the notifier feeds Hungarian customer/operator copy, so the
+					// reserved key is mapped HERE rather than at each wiring site — a live demo run
+					// pushed a literal "_shares" event before this was moved to the source.
+					m.tier2Notify(DisplayStackName(SharesPseudoStack), target.Label, time.Since(start), err)
 				}
 				return fmt.Errorf("tier2 shares mirror %s: %w", sh.Name, err)
 			}
@@ -249,7 +252,7 @@ func (m *Manager) RunSharesTier2() error {
 	}
 	m.recordTier2Success(SharesPseudoStack, lastTarget, totalSize, strings.Join(warns, " "), dur)
 	if m.tier2Notify != nil {
-		m.tier2Notify(SharesPseudoStack, lastTarget.Label, dur, nil)
+		m.tier2Notify(DisplayStackName(SharesPseudoStack), lastTarget.Label, dur, nil)
 	}
 	m.logger.Printf("[INFO] [shares] tier-2 run complete: %d share leg(s), %s, %s",
 		mirrored, humanizeBytes(totalSize), dur.Round(time.Second))