v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_placement.go

@@ -164,8 +164,8 @@ func (m *Manager) RecordedUnitForStack(stack string) (RecordedPlacement, Recorde
 	}
 	addRoot(m.systemDataPath)
 
-	for _, root := range roots {
-		unit := RecoveryUnitPath(root, stack)
+	for _, nsRoot := range roots {
+		unit := RecoveryUnitPath(nsRoot, stack)
 		man := readManifest(filepath.Join(unit, "manifest.json"))
 		if man == nil {
 			continue