v0.325.0: share + escrow limiters reserve first; family sessions as fingerprints; samba renames apply; path guard widened; gates in a worktree

R-1111 reserveAttempt is the one limiter body (share password, escrow re-auth, dashboard sign-in). R-1112
family.json holds fingerprints; old files are converted at load. R-1113 the household's pass reuses its
family session. R-1109 the samba compose carries the smb.conf hash. R-1110 TestNoBareDrivePathToPathHelpers.
R-1114 shared_scripts.py resolves the felhom.eu sibling from a worktree. Each red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/removed_units.go

@@ -121,8 +121,8 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 	}
 	seen := make(map[string]bool)
 	var out []RemovedAppUnit
-	for _, root := range m.primaryUnitRoots() {
-		entries, err := os.ReadDir(PrimaryBackupPath(root))
+	for _, nsRoot := range m.primaryUnitRoots() {
+		entries, err := os.ReadDir(PrimaryBackupPath(nsRoot))
 		if err != nil {
 			continue
 		}
@@ -131,7 +131,7 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 			if !e.IsDir() || deployed[name] || seen[name] {
 				continue
 			}
-			unitDir := RecoveryUnitPath(root, name)
+			unitDir := RecoveryUnitPath(nsRoot, name)
 			man := readManifest(UnitManifestFile(unitDir))
 			if man == nil {
 				continue
@@ -149,7 +149,7 @@ func (m *Manager) ListRemovedAppUnits() []RemovedAppUnit {
 				StackName:   name,
 				DisplayName: display,
 				UnitDir:     unitDir,
-				DriveLabel:  m.driveLabelForRoot(root),
+				DriveLabel:  m.driveLabelForRoot(nsRoot),
 				Time:        newest.UTC().Format(time.RFC3339),
 			})
 		}