v0.328.0 (unreleased): security review round 3 — under HDD_PATH only appdata/ is a data root (not backups/)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/privpolicy/privpolicy_test.go

@@ -406,3 +406,14 @@ func TestAdmit_ANotYetCreatedPathBehindASymlink(t *testing.T) {
 		t.Fatal("a resolve error other than not-exist was admitted (fail open)")
 	}
 }
+
+// Round 3: ${HDD_PATH} itself and its siblings of appdata/ (backups/ — the recovery units with app secrets) are no
+// root; ${HDD_PATH}/appdata/... is.
+func TestAdmit_HDDPathRootIsAppdataOnly(t *testing.T) {
+	for _, line := range []string{"      - ${HDD_PATH}:/drive\n", "      - ${HDD_PATH}/backups:/b\n", "      - ${HDD_PATH}/appdata-x:/b\n"} {
+		compose := strings.Replace(base, "      - app_data:/data\n", "      - app_data:/data\n"+line, 1)
+		if err := admit(t, "app", compose, env()); err == nil {
+			t.Fatalf("%q was admitted", line)
+		}
+	}
+}