Resume a backup the node agent's own stop interrupted, and keep what a held module runs

On novox (2026-10-31) postgres's repeat backup was interrupted by the node-engine's
restart: its held have named no build, so the node's own composition took postgres in
and was refused for its secret reader, and nothing ran the backup again. Issue 1289
(R4c, its delivery held).

- A held have names what runs: read from the module's have before backing-up when
  the agent has no running entry, as the not-composed mark does.
- A have in any phase but running that names nothing is not run inside the node's own.
- A backup interrupted by the agent's stop is no failure: the next start backs the
  module up again and applies while the want asks a backup. A real failure stays
  held for the operator's answer.

Quick fix: a new backup ask by hand. Thorough, chosen: the fault fixed where it lives
in the node agent, so every data module's interrupted backup resumes by itself.

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

internal/selfcompose/selfcompose_test.go

@@ -1760,6 +1760,10 @@ func TestAHaveSaysWhetherItsModuleRunsInsideTheNodesOwn(t *testing.T) {
 		{"running with no fingerprint (mesh-wireguard)", delivery.Have{Phase: delivery.PhaseRunning, Health: delivery.HealthOK}, true, false},
 		{"held today", delivery.Have{FP: "build-0123abcd", Composed: "sha256:" + strings.Repeat("c", 64), Phase: delivery.PhaseHeld,
 			Health: delivery.HealthWaits, Detail: "held: a required config value is unset"}, true, true},
+		// postgres on novox (2026-10-31): held by a backup the node agent's restart interrupted, its have naming nothing
+		// it runs; counted in, it was composed from its manifest past its build and refused for its secret reader.
+		{"held, naming nothing it runs", delivery.Have{Phase: delivery.PhaseHeld, Health: delivery.HealthWaits,
+			Detail: "the node agent was stopped while the backup ran"}, false, true},
 	} {
 		t.Run(row.name, func(t *testing.T) {
 			c := New(Env{Node: "n1"})