v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

controller/README.md

@@ -1191,9 +1191,11 @@ correction, an update or ladder step, a unit or off-site restore — first rende
 (`network_mode`/`pid`/`ipc`/`uts`/`userns_mode`/`cgroup`), `security_opt` other than `no-new-privileges`, `sysctls`,
 `volumes_from`, `build`/`include`/`extends` files, an `env_file` or config file outside the stack directory, a named
 volume with a driver/`driver_opts`/`external`/`name`, a `${VAR}` inside any of those, and any bind outside the data
-roots the box itself gives (`${HDD_PATH}`, `${USERDATA_PATH}`, `${IMPORT_PATH}`) or of the Docker socket. Such a setting
-is refused unless this app's service has EXACTLY that setting on the list compiled into the controller
-(`internal/privpolicy/allowlist.json` — today one entry: homepage's read-only Docker socket). A refusal writes nothing:
+roots the box itself gives (`${HDD_PATH}/appdata/<the app's own folder>`, `${USERDATA_PATH}`, `${IMPORT_PATH}`) or of the
+Docker socket. The folder is the app's name unless the list's `appdata_folders` names it (paperless-ngx → `paperless`;
+v0.329.0, R-1142), so one app cannot bind another app's files. Such a setting is refused unless this app's service has
+EXACTLY that setting on the list compiled into the controller (`internal/privpolicy/allowlist.json` — EMPTY since
+v0.329.0: homepage's Docker socket served no Felhom feature and is gone, R-981). A refusal writes nothing:
 a refused correction or update leaves the app running on its last good compose, raises the operator-only hub event
 `app_definition_refused` once per refused definition, and puts one line on the app page; a refused install, settings
 change or restore is refused with a plain message („Semmi nem változott"). A catalog template named like a controller