hub v0.90.1 — the digest's per-app lines stop repeating the filesystem figures (R-182)

Found by reading the first REAL digest, not by design. Every app row ended with
the same usage clause the mail already prints once on its own Filesystem line.
On a two-app box that is untidy; down a list of a dozen it is the same forty
characters twelve times, pushing the part that DIFFERS off a phone screen at
07:00 — the only moment this mail has to work.

The reserve's refusal message is authored for a single-app alert where naming
the filesystem is right, so the message is unchanged; the digest trims the
duplicate when rendering. trimRepeatedUsage removes ONLY an exact
"— <target path>:" suffix, so an unrelated reason is untouched and a reason that
is nothing but the usage clause is left alone rather than emptied.

Also updates TestRecoveryUnitCaptureFailed_NeverReachesTheCustomer, which
required the OPERATOR to be emailed a per-app capture failure. That was correct
when the event was the only signal and is wrong now that it is the record and
the digest is the notification. Its customer-safety claim is unchanged and is
why the test still exists; the operator assertion is inverted with the reasoning
written in place, and R-158's guarantee is shown to have MOVED, not weakened.

hub/internal/notify/templates.go

@@ -361,7 +361,7 @@ func renderBackupRunFailures(customerID, detailsJSON string) (string, string, bo
 	var b strings.Builder
 	fmt.Fprintf(&b, "\n\nFAILED: %d of %d apps attempted in this %s run.\n\n", d.Failed, d.Attempted, kind)
 	for _, a := range d.Apps {
-		reason := a.Reason
+		reason := trimRepeatedUsage(a.Reason, d.TargetPath)
 		if reason == "" {
 			reason = "(no reason recorded)"
 		}
@@ -382,3 +382,27 @@ func renderBackupRunFailures(customerID, detailsJSON string) (string, string, bo
 	b.WriteString("whether or not this mail was sent.")
 	return b.String(), subject, true
 }
+
+// trimRepeatedUsage strips the trailing "— /path: X/Y GB used (Z%), W GB free" clause from a per-app
+// reason, because the digest prints those figures ONCE for the whole run on its own line.
+//
+// This is a copy fix, and it was made after reading the first real digest rather than from the
+// design. The reserve's refusal message is authored for a single-app alert, where naming the
+// filesystem is exactly right; repeated down a list of a dozen apps it is the same forty characters
+// twelve times, and it pushes the part that differs off the right-hand edge of a phone screen at
+// 07:00 — which is the only moment this mail has to work.
+//
+// It trims ONLY an exact "— <target path>:" suffix, so a reason that mentions a different path, or
+// none, is left completely alone. A reason that is nothing but the usage clause is left alone too:
+// removing everything would turn a bad line into an empty one.
+func trimRepeatedUsage(reason, targetPath string) string {
+	if reason == "" || targetPath == "" {
+		return reason
+	}
+	marker := " — " + targetPath + ":"
+	i := strings.LastIndex(reason, marker)
+	if i <= 0 {
+		return reason
+	}
+	return strings.TrimSpace(reason[:i])
+}