controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/monitor/healthcheck.go

@@ -2,9 +2,9 @@ package monitor
 
 import (
 	"fmt"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec"
 	"log"
 	"os"
-	"os/exec"
 	"strings"
 	"time"
 
@@ -280,7 +280,7 @@ func (r *HealthReport) FormatMessage() string {
 }
 
 func checkDocker() error {
-	cmd := exec.Command("docker", "info", "--format", "{{.ServerVersion}}")
+	cmd := dockerexec.Command("docker", "info", "--format", "{{.ServerVersion}}")
 	out, err := cmd.Output()
 	if err != nil {
 		return fmt.Errorf("docker not reachable: %v", err)
@@ -342,7 +342,7 @@ func EffectiveProtected(cfg *config.Config, smb settings.SMBSettings) []string {
 func checkProtectedContainers(protected []string) []string {
 	var missing []string
 	for _, name := range protected {
-		cmd := exec.Command("docker", "inspect", "--format", "{{.State.Running}}", name)
+		cmd := dockerexec.Command("docker", "inspect", "--format", "{{.State.Running}}", name)
 		out, err := cmd.Output()
 		if err != nil {
 			missing = append(missing, name)