v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt,
sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes,
binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an
allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose
write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores
(before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only
event app_definition_refused once per definition and puts one line on the app page. The sync never copies a
template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/i18n/locales/en.json

@@ -194,6 +194,7 @@
   "app_info.mire_hasznalhato": "What is it for?",
   "app_info.naplo": "Log",
   "app_info.hold_log_kept": "The app's own log from before it was stopped was kept — it shows why the new version did not start.",
+  "app_info.definition_refused": "The box did not accept the catalog's newer definition of this app: it asks for rights the box does not give. The app keeps running on its last good definition; the operator has been told.",
   "app_info.nincs_folyamatban_athelyezes": "No move in progress.",
   "app_info.regi_adatok_torlese": "Deleting old data",
   "app_info.telepites": "Install",
@@ -2695,6 +2696,7 @@
   "login.msg.wrong_password": "Wrong password.",
   "err.stacks.family_gate_failed": "The family gate could not be prepared, so the app was not installed: %s",
   "err.stacks.needs_newer_controller": "This app needs newer box software, so it was not installed: %s",
+  "err.stacks.definition_refused": "The box does not allow this: the definition of %s asks for rights on the machine that the box does not give (%s). Nothing was changed.",
   "family_gate.page_title": "Family sign-in",
   "family_gate.page_body": "Open this app with your family name and password.",
   "family_gate.name": "Your name",

controller/internal/i18n/locales/hu.json

@@ -190,6 +190,7 @@
   "app_info.mire_hasznalhato": "Mire használható?",
   "app_info.naplo": "Napló",
   "app_info.hold_log_kept": "Az alkalmazás saját naplója megmaradt a leállítás előttről — ebből látszik, miért nem indult el az új változat.",
+  "app_info.definition_refused": "A katalógus újabb leírását ehhez az alkalmazáshoz a doboz nem fogadta el, mert olyan jogot kér, amit a doboz nem ad meg. Az alkalmazás a legutóbbi jó beállításaival fut tovább; az üzemeltetőt értesítettük.",
   "app_info.nincs_folyamatban_athelyezes": "Nincs folyamatban áthelyezés.",
   "app_info.regi_adatok_torlese": "Régi adatok törlése",
   "app_info.telepites": "Telepítés",
@@ -2683,6 +2684,7 @@
   "login.msg.wrong_password": "Hibás jelszó.",
   "err.stacks.family_gate_failed": "A családi kapu nem készült el, ezért nem telepítettük az alkalmazást: %s",
   "err.stacks.needs_newer_controller": "Ehhez az alkalmazáshoz újabb doboz-szoftver kell, ezért most nem telepítettük: %s",
+  "err.stacks.definition_refused": "A doboz ezt nem engedi: a(z) %s leírása olyan jogot kér a géptől, amit a doboz nem ad meg (%s). Semmi nem változott.",
   "family_gate.page_title": "Családi belépés",
   "family_gate.page_body": "Ezt az alkalmazást a családi neveddel és jelszavaddal nyithatod meg.",
   "family_gate.name": "Neved",