v0.328.0 (unreleased): security review round 3 — under HDD_PATH only appdata/ is a data root (not backups/)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/privpolicy/privpolicy.go

@@ -512,6 +512,12 @@ func (c *checker) validRoots() []string {
 			continue
 		}
 		if strings.HasPrefix(v, DriveNamespace) || (c.p.SystemDataPath != "" && within(v, filepath.Clean(c.p.SystemDataPath))) {
+			if r == "HDD_PATH" {
+				// round 3: HDD_PATH is the drive's whole namespace — its backups/ (recovery units carry app secrets)
+				// and every other top-level folder are siblings an app has no business binding. Only appdata/ is a
+				// root; the household's folders come through USERDATA_PATH.
+				v = filepath.Join(v, "appdata")
+			}
 			out = append(out, v)
 		}
 	}