v0.329.0: each app reaches only its own appdata folder; empty allow-list; drive retirement asks the agent first; plain no-durable-id refusal; :latest only for a release

R-1142: the HDD_PATH root is appdata/<own folder>, with a compiled-in folder map (paperless-ngx ->
paperless). R-981: the allow-list is empty (homepage's socket served no Felhom feature). R-1063:
finalizeDecommissionWith asks the agent before it marks the drive or moves the default; the 403/409
come back typed and reach the household as a plain 409. R-1069: the agent's no-durable-id format
refusal is ErrNoDurableID and a plain sentence. R-1143: build.sh carries :latest only for x.y.z.
Each pinned by a red-proofed test. MinAgent 0.158.1.

controller/internal/web/storage_handlers_test.go

@@ -57,6 +57,7 @@ type mockAgent struct {
 	formatStatusCalls int
 	guestAttachCalls  []string
 	decommissionCalls []string
+	decommissionErr   error
 	guestRebootCalls  int
 	guestRebootErr    error
 	candidates        agentapi.CandidatesResult
@@ -99,6 +100,9 @@ func (m *mockAgent) EjectDisk(_ context.Context, where string) (agentapi.EjectRe
 }
 func (m *mockAgent) Decommission(_ context.Context, where string) (agentapi.DecommissionResult, error) {
 	m.decommissionCalls = append(m.decommissionCalls, where)
+	if m.decommissionErr != nil {
+		return agentapi.DecommissionResult{}, m.decommissionErr
+	}
 	return agentapi.DecommissionResult{Decommissioned: where}, nil
 }
 func (m *mockAgent) GuestAttach(_ context.Context, where string) error {