v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox.go

@@ -1303,11 +1303,11 @@ func (m *Manager) offboxCandidateNSRoots() []string {
 // back to the unit dir mtime) and WARNs about the others. Independent of the app's live deploy state.
 func (m *Manager) discoverOffboxUnit(app string) (string, bool) {
 	var foundSrc, foundManifest []string
-	for _, nr := range m.offboxCandidateNSRoots() {
-		p := RecoveryUnitPath(nr, app)
+	for _, nsRoot := range m.offboxCandidateNSRoots() {
+		p := RecoveryUnitPath(nsRoot, app)
 		if fi, err := os.Stat(p); err == nil && fi.IsDir() {
 			foundSrc = append(foundSrc, p)
-			foundManifest = append(foundManifest, RecoveryUnitManifestPath(nr, app))
+			foundManifest = append(foundManifest, RecoveryUnitManifestPath(nsRoot, app))
 		}
 	}
 	switch len(foundSrc) {