v0.75.0: gate userdata MkdirAll on a live mountpoint (no writes into an absent drive)

Belt (ensureUserdataMounts) + FileBrowser sync skip ensure/mount when an external
drive root is not a live mountpoint -> no 'mkdir userdata: permission denied' + no
rootfs-shadow during a drive-absent window. System/local path never gated. Reuses
system.IsMountPoint; matches planDriveGates external-only rule. T1-T4 + red-proofs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/filebrowser_gate_test.go

@@ -0,0 +1,25 @@
+package web
+
+import "testing"
+
+// T4: skipFileBrowserPath skips ONLY an external drive path (under StableParentDir) that is not a live
+// mountpoint. A mounted external path and any system/local path are never skipped.
+// Companion red-proof: dropping the gate (always-false) makes the absent-usb case fail.
+func TestSkipFileBrowserPath(t *testing.T) {
+	// flash is mounted; usb is not.
+	isMount := func(p string) bool { return p == StableParentDir+"/flash" }
+
+	cases := []struct {
+		path string
+		want bool
+	}{
+		{StableParentDir + "/flash", false},  // external + mounted → keep
+		{StableParentDir + "/usb", true},     // external + NOT mounted → skip
+		{"/mnt/sys_drive/felhom-data", false}, // system path (not under StableParentDir) → never skip
+	}
+	for _, c := range cases {
+		if got := skipFileBrowserPath(c.path, isMount); got != c.want {
+			t.Errorf("skipFileBrowserPath(%q) = %v, want %v", c.path, got, c.want)
+		}
+	}
+}