controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,26 @@
+## v0.267.0 — tests never touch DooPlex's Docker, a cut-off copy is never loaded, two pages tell the truth (2026-09-23, R-650, R-640, R-499, R-518; R-626 measured)
+
+**MinAgent: 0.131.0** (unchanged). No hub change. New strings: yes (hu + en).
+
+- **R-650 — a unit test can no longer act on production Docker.** New `internal/dockerexec`: every docker
+  exec in the controller goes through it, and under `go test` a real docker is refused with an error
+  naming the command (opt-in `FELHOM_TEST_REAL_DOCKER=1`; a stub under the temp dir is allowed). The sweep
+  found **8 `api` tests** and the `stacks`/`web` fixtures running real `docker ps` / `docker compose
+  version` on DooPlex, and one `stacks` test reaching a real `docker-compose down`; those packages now run
+  under a silent stub (`RunWithStub`). `backup`, `appexport`, `system` tests read `docker ps`/`info` and
+  pass on the refusal. `TestR650_NoBareDockerExec` pins the invariant repo-wide.
+- **R-640 — a cut-off database copy is refused before anything is touched.** `appbackup.CheckDumpComplete`
+  reads the end of the copy for the engine's completion marker. The unit restore and the off-site
+  restore refuse before the first mutation („…adatbázis-másolata csonka… nem indult el”); every replay
+  checks again right before the load, whatever the import seam is.
+- **R-499 — the system-disk sentence says where THIS box's whole-system backup goes.** Four branches
+  (own drive / same disk / drive gone / cannot ask); „(PBS)” and „nincs külön teendő” only where true.
+- **R-518 — the backup button states the measured stop** (about 8 minutes on a 12-app box). The brief's
+  „csak néhány másodpercre” was already gone since v0.243.0; the vague „általában néhány perc” is replaced.
+- **R-626 measured, not reproduced:** remove → 390 s of `docker events` (the remove's destroy seen, no
+  create) + a controller restart + a guest reboot → no container, no volume.
+- Red-proofs: eight, each seen failing (REPORT).
+
 ## v0.266.0 — a failed install removes what it started (2026-09-23, R-649)
 
 **MinAgent: 0.131.0** (unchanged). No new strings. No hub change.