v0.308.0: controller batch 2026-10-12 — clear-address warning (R-922), secret sweep over every page (R-255), read_failed (R-266), no NVMe heat band (R-333), share globe (R-577), Hungarian dates and numbers (R-562), lost-drive option pinned (R-521)

Operator rulings 2026-10-12, 09 §3 decisions 196, 204-207, 223, 227. MinAgent 0.131.0 unchanged.
R-255's sweep found one leak, fixed here: an optional-config secret_input was rendered into its
settings page; it is now revealed on demand. Hungarian parity fixtures re-captured once for R-562.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/offbox_handlers.go

@@ -568,7 +568,7 @@ const offsiteScratchIncompleteKey = "note.restore.scratch_incomplete"
 func reconstituteOutcomeMsg(app string, res backup.OffsiteReconstituteResult, lang string) string {
 	when := ""
 	if !res.DumpsAt.IsZero() {
-		when = util.Text(lang, "note.restore.dumps_at", res.DumpsAt.In(getTimezone()).Format("2006-01-02 15:04"))
+		when = util.Text(lang, "note.restore.dumps_at", fmtLocalTime(lang, res.DumpsAt))
 	}
 	// R-354 — WHAT ACTUALLY CAME BACK, NAMED. The volume leg is stated whenever it returned anything,
 	// because a restore that replayed an app's entire dataset and mentioned only its file count is