controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/infra.go

@@ -2,8 +2,8 @@ package stacks
 
 import (
 	"fmt"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec"
 	"os"
-	"os/exec"
 	"path/filepath"
 	"strings"
 
@@ -221,7 +221,7 @@ func (m *Manager) wireController(traefikDir string) error {
 	}
 
 	if !containerOnNetwork(controllerContainer, traefikNetwork) {
-		out, err := exec.Command("docker", "network", "connect", traefikNetwork, controllerContainer).CombinedOutput()
+		out, err := dockerexec.Command("docker", "network", "connect", traefikNetwork, controllerContainer).CombinedOutput()
 		if err != nil && !strings.Contains(string(out), "already exists") {
 			return fmt.Errorf("network connect %s: %s: %w", controllerContainer, strings.TrimSpace(string(out)), err)
 		}
@@ -234,7 +234,7 @@ func (m *Manager) wireController(traefikDir string) error {
 // We list the network names and match exactly — NOT `{{index .Networks "name"}}`, whose output for an
 // absent key is "<nil>" (a non-empty string), which would falsely read as "already attached".
 func containerOnNetwork(name, network string) bool {
-	out, err := exec.Command("docker", "inspect", "--format",
+	out, err := dockerexec.Command("docker", "inspect", "--format",
 		"{{range $k, $_ := .NetworkSettings.Networks}}{{$k}}\n{{end}}", name).Output()
 	if err != nil {
 		return false
@@ -250,14 +250,14 @@ func containerOnNetwork(name, network string) bool {
 // ensureTraefikNetwork creates the external traefik-public docker network if absent (idempotent;
 // tolerates a create/inspect race). Uses the docker CLI directly — it's a network op, not compose.
 func (m *Manager) ensureTraefikNetwork() error {
-	if exec.Command("docker", "network", "inspect", traefikNetwork).Run() == nil {
+	if dockerexec.Command("docker", "network", "inspect", traefikNetwork).Run() == nil {
 		return nil
 	}
 	m.logger.Printf("[INFO] [infra] creating docker network %s", traefikNetwork)
-	out, err := exec.Command("docker", "network", "create", traefikNetwork).CombinedOutput()
+	out, err := dockerexec.Command("docker", "network", "create", traefikNetwork).CombinedOutput()
 	if err != nil {
 		// Tolerate a race where another actor created it between our inspect and create.
-		if exec.Command("docker", "network", "inspect", traefikNetwork).Run() == nil {
+		if dockerexec.Command("docker", "network", "inspect", traefikNetwork).Run() == nil {
 			return nil
 		}
 		return fmt.Errorf("network create %s: %s: %w", traefikNetwork, strings.TrimSpace(string(out)), err)
@@ -295,7 +295,7 @@ func writeInfraFiles(dir string, files map[string]infra.FileSpec) error {
 // containerRunning reports whether a container with the given name is currently running. It asks the
 // daemon directly (works before the stack dir exists), mirroring monitor.checkProtectedContainers.
 func containerRunning(name string) bool {
-	out, err := exec.Command("docker", "inspect", "--format", "{{.State.Running}}", name).Output()
+	out, err := dockerexec.Command("docker", "inspect", "--format", "{{.State.Running}}", name).Output()
 	if err != nil {
 		return false
 	}