fix(R-1220): an unreadable app.yaml counts as installed — its folders are never kept data

liveDriveBinds(drives): an app whose app.yaml exists but does not parse binds every folder its compose names on
every drive (fail closed); WARN per app. Red-proved (the live folder was listed). Commit only.

CHANGELOG.md

@@ -9,6 +9,11 @@ hub answers 400 to both and nothing else changes.
   as `restore_failed` — `since`, `why`), `app_hold_cleared` when a hold is gone; every hold is sent again once a day and
   at each start (`repeat: true`). The last-reported set is kept in `settings.reported_holds`, so a hold cleared while the
   controller was down is still reported cleared. Both severity info (the hub mails nothing on receipt).
+- **R-1220 (P2, delete path):** an app whose `app.yaml` EXISTS but cannot be read counts as INSTALLED (fail closed):
+  `stacks.liveDriveBinds(drives)` adds every folder its compose binds on every given drive, so „Megőrzött adatok" never
+  lists — and never offers to delete — that app's live folder; one WARN names the app. Before: a parse error gave a nil
+  `AppConfig`, the app read as not installed, its folder was a „leftover". Test `TestR1220_AnUnreadableAppYamlKeepsTheFolderLive`
+  (with a real leftover as the control), red-proved against the old code.
 - `settings.RestoreHold.Why()` / `WireReason()`: the hold sentence moved out of `cmd/controller` (`holdWhy` calls it), so
   `--restore-holds` and the hub's list say the same thing.
 - Tests `internal/holdreport/holdreport_test.go` (8): the report field, the daily repeat, cleared once, cleared while