R-528: the 30-s OOM scan also reads the host's per-container kernel counter (agent GET /guest/oom-kills)

A count above 0 in a running container's current run fires the existing app_oom line (source cgroup/docker in the
details), whatever Docker's OOMKilled says. Old agent: 404 back-off; no agent: Docker's flag only.
Tests TestR528_* red first / red-proved. Commit only.

controller/internal/stacks/manager.go

@@ -284,6 +284,8 @@ type Manager struct {
 	// R-514: last OOM scan (oom.go), for the dashboard.
 	oomMu    sync.Mutex
 	oomCache map[string][]string
+	// hostOOMKills (R-528) is the host agent's per-container OOM counter; nil = Docker's flag only (SetHostOOMKills).
+	hostOOMKills func() map[string]int64
 	// R-513: FileBrowser admin-password seams (filebrowser_password.go); nil/"" in production.
 	fbHTTP    fbHTTPDo
 	fbBaseURL string