v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

Security review of 2fe6341 (same night, before any release). Both red-proofed.

controller/internal/privpolicy/privpolicy_test.go

@@ -527,6 +527,21 @@ func TestAllowList_AppdataFolderMustBeOneName(t *testing.T) {
 			mustLoad([]byte(`{"version":2,"entries":[],"appdata_folders":{"app":"` + bad + `"}}`))
 		}()
 	}
+	// Security review 2026-10-18: an app NAMED like a folder the map gives to another app gets no root at all.
+	if got := AppdataFolder("paperless"); got != "" {
+		t.Errorf("AppdataFolder(paperless) = %q — a template named like paperless-ngx's folder must not own it", got)
+	}
+	if err := admit(t, "paperless", "services:\n  app:\n    image: x/y:1\n    volumes:\n      - ${HDD_PATH}/appdata/paperless/media:/m\n", env()); err == nil {
+		t.Error("a template named paperless was admitted to paperless-ngx's folder")
+	}
+	func() {
+		defer func() {
+			if recover() == nil {
+				t.Error("one folder given to two apps was loaded")
+			}
+		}()
+		mustLoad([]byte(`{"version":2,"entries":[],"appdata_folders":{"a":"x","b":"x"}}`))
+	}()
 	if got := AppdataFolder("paperless-ngx"); got != "paperless" {
 		t.Errorf("AppdataFolder(paperless-ngx) = %q", got)
 	}