R-1110: the guard's census is 42 calls, not 41 (measured; comment and CHANGELOG)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/appbackup/userdata_bare_drive_guard_test.go

@@ -80,7 +80,7 @@ func TestNoBareDrivePathToUserdataDir(t *testing.T) {
 // AppDataDir and PrimaryBackupPath take a NAMESPACE ROOT too (the NamespaceRootFor contract names all four), and
 // package backup re-exports them, so both packages' calls are read. Same acceptance rule as above.
 //
-// THE CENSUS on 2026-10-17 (41 calls): every one passed a namespace root, but two only by a comment —
+// THE CENSUS on 2026-10-17 (42 calls): every one passed a namespace root, but two only by a comment —
 // stacks/delete.go GetStackBackupData's parameter was named drivePath (its one caller passes AppNamespaceRoot),
 // and web/handlers.go appDetailsForPath passed a registered StoragePath, which is its namespace root only while
 // the system drive is never a StoragePath. The first was renamed nsRoot; the second now goes through
@@ -118,7 +118,7 @@ func TestNoBareDrivePathToPathHelpers(t *testing.T) {
 		}
 	}
 	if len(calls) < 30 {
-		t.Errorf("the census found %d calls; 41 on 2026-10-17 — a shrink this large is a scope bug, not a cleanup", len(calls))
+		t.Errorf("the census found %d calls; 42 on 2026-10-17 — a shrink this large is a scope bug, not a cleanup", len(calls))
 	}
 	for _, v := range violations {
 		t.Errorf("%s:%d (%s): %s — the first argument is not a namespace root by construction. "+