controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

R-487: the local backup lists are keyed on the drives, not on what is
deployed — a removed app whose unit was kept is listed with the restore
that reinstalls it, the picker answers for it, and the restore opens the
unit where it sits. R-491: a removal clears the app's update hold.
R-490: /api/system/info reaches the API router and reads the default
storage path. R-489: volumes_removed is the real before/after difference,
[] when none. R-476: a Tier-2 copy is dated by its data, not its manifest.
R-456: the boot-orphan rule is pinned. Every fix red-proofed.

controller/internal/stacks/manager.go

@@ -1610,3 +1610,9 @@ func (m *Manager) getCatalogTemplateSlugs() map[string]bool {
 	}
 	return slugs
 }
+
+// AggregateStateForTest exposes aggregateState with every member supervised, to tests outside this
+// package — R-456's pin lives in bootrecon.
+func AggregateStateForTest(containers []ContainerInfo) ContainerState {
+	return aggregateState(containers, func(string) string { return "unless-stopped" })
+}