R-100: record the offsite last-SUCCESS anchor (v0.181.0)

LastRun records an attempt, not a result. New OffboxTarget.LastSuccess, set only on the
success branch via the pure offboxAnchorAfterRun rule, carried to the hub as last_success.
Closes two silent-wipe sites (settings save, hub re-apply).

controller/internal/settings/settings.go

@@ -161,8 +161,21 @@ type OffboxTarget struct {
 	QuotaGB int `json:"quota_gb,omitempty"`
 
 	// Runtime status (written by the off-box runner; never holds a secret).
-	LastRun       string `json:"last_run,omitempty"`    // RFC3339
-	LastStatus    string `json:"last_status,omitempty"` // "ok" | "error" | "running"
+	LastRun    string `json:"last_run,omitempty"`    // RFC3339
+	LastStatus string `json:"last_status,omitempty"` // "ok" | "error" | "running"
+	// LastSuccess (R-100) is the RFC3339 stamp of the last run that actually SUCCEEDED.
+	//
+	// IT EXISTS BECAUSE LastRun RECORDS AN ATTEMPT, NOT A RESULT. LastRun is written
+	// unconditionally at the end of every run, including failures, so "how long since LastRun" answers
+	// "how long since we last TRIED" — which is not the question any freshness verdict is asking. The
+	// hub's OffsiteChecker asked exactly that question of exactly that field, so a tier failing on
+	// every run read as perfectly fresh forever.
+	//
+	// Written ONLY on the success branch. Never cleared by a failure: a tier that succeeded on Monday
+	// and has failed every night since must keep Monday's stamp, because that stamp is precisely what
+	// makes the staleness threshold elapse. Clearing it on failure would restore the bug in mirror
+	// image (an instantly-stale tier on the first blip — the F-A1 noise path).
+	LastSuccess   string `json:"last_success,omitempty"` // RFC3339
 	LastError     string `json:"last_error,omitempty"`
 	LastDuration  string `json:"last_duration,omitempty"`
 	RepoSizeHuman string `json:"repo_size_human,omitempty"`