C6B-F2: refuse network-share removal while a deployed app binds it

handleNetStorageRemove now refuses (409, Hungarian, names the apps) when any
DEPLOYED stack's HDD_PATH is the share root or a subpath of it — the C6B live
event removed campaign6 under a running sonarr, and the agent's tolerated
best-effort stop steps then deleted the unit files under the busy mount,
leaving an unreapable orphaned autofs mount until host reboot. The guard cuts
that chain off at the product flow. The remove handler resolves the agent via
the netAgent seam (netAgentForAdd), making the negative control testable.
NOTE: the agent-side residual (tolerate-and-continue stop in felhom-agent
netmount.go RemoveNetworkMount) is out of this controller-only task's scope —
flagged in REPORT for a follow-up agent task. Red-proof recorded: disabling
the guard returns the live pre-fix removed:true.

controller/internal/web/netstorage_job.go

@@ -113,7 +113,9 @@ func (s *netAddState) snapshot() *netAddJob {
 	return &cp
 }
 
-// netAgentForAdd resolves the orchestrator's agent surface (test seam first, then the shared client).
+// netAgentForAdd resolves the net-storage agent surface (test seam first, then the shared
+// client). Despite the name it serves the whole share lifecycle — the remove handler resolves
+// through it too (v0.130.0).
 func (s *Server) netAgentForAdd() (netAgent, error) {
 	if s.netAgentFn != nil {
 		return s.netAgentFn()