v0.328.0: the catalog allow-list — the box refuses container rights a template asks for and the box does not give (R-971, D2 = A)

internal/privpolicy checks the RENDERED compose (privileged, cap_add, devices, host namespaces, security_opt,
sysctls, volumes_from, build/include/extends, env_file/config files outside the stack dir, aliasing named volumes,
binds outside the box's data roots, the Docker socket, propagation, ${VAR} in a privileged key) against an
allow-list compiled into the controller (one entry: homepage's read-only socket). Asked before every compose
write: the 15-minute sync, the guarded update/ladder step, the install, both settings changes, both restores
(before the stop). A refusal writes nothing, keeps the app on its last good compose, raises the operator-only
event app_definition_refused once per definition and puts one line on the app page. The sync never copies a
template named like a controller infra stack. Structural guard TestAllowList_IsWiredIntoEveryComposeWriter.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/i18n_parity_test.go

@@ -508,6 +508,18 @@ func i18nCases() []i18nCase {
 		d["HoldLogKept"] = true
 		return d
 	}})
+	// R-971 (v0.328.0): the box refused the catalog's newer definition of an installed app — the app page's line,
+	// captured when born.
+	base = append(base, i18nCase{"app_settings_definition_refused", "app_settings", func() map[string]interface{} {
+		d := i18nLayoutData("stacks", "Homepage")
+		st := stacks.Stack{Name: "homepage", Deployed: true, State: stacks.StateRunning,
+			DefinitionRefused: "the catalog definition of homepage asks for container rights the box does not allow: homepage: privileged true"}
+		st.Meta = stacks.Metadata{DisplayName: "Homepage", Slug: "homepage"}
+		d["Stack"] = st
+		d["Meta"] = st.Meta
+		d["AppInfo"] = st.Meta.AppInfo
+		return d
+	}})
 	// v0.320.0 — logins and folders: the infra app page (FileBrowser), the two login sentences a catalog key
 	// chooses, and the „Fajlok" button with a media folder and a folder whose drive is away. Captured when born.
 	infraFB := func() map[string]interface{} {