v0.329.0 (review): an app named like another app's appdata folder gets no root; USERDATA_PATH is always derived, never the app's env

Security review of 2fe6341 (same night, before any release). Both red-proofed.

controller/internal/stacks/allowlist_test.go

@@ -89,6 +89,17 @@ func TestAllowList_PolicyEnvDerivesTheRootsLikeComposeExec(t *testing.T) {
 	if e["USERDATA_PATH"] == "/" || !strings.HasPrefix(e["USERDATA_PATH"], "/mnt/felhom-drives/a/") {
 		t.Fatalf("USERDATA_PATH = %q — the app's own value must not become a data root", e["USERDATA_PATH"])
 	}
+	// Security review 2026-10-18: with NO drive, an app-env USERDATA_PATH (a deploy field a catalog push can add) is
+	// no root either — it could name another app's appdata/. Consequence: such a bind is refused.
+	// RED-PROOF: without the delete in policyEnv, the bind into nextcloud's folder is admitted.
+	noHDD := map[string]string{"USERDATA_PATH": "/mnt/felhom-drives/a/felhom-data/appdata"}
+	if v, ok := m.policyEnv(noHDD)["USERDATA_PATH"]; ok {
+		t.Fatalf("an app with no drive kept its own USERDATA_PATH %q as a root", v)
+	}
+	c := "services:\n  web:\n    image: x/y:1\n    volumes:\n      - ${USERDATA_PATH}/nextcloud:/x\n"
+	if err := m.admitCompose("web", []byte(c), noHDD); err == nil {
+		t.Fatal("a bind into another app's folder through an app-env USERDATA_PATH was admitted")
+	}
 }
 
 // The install / settings / restore refusal is a bundle key: the reader gets it in their language, with the app and