admin
c432f701dd
realVolumeSize mounts the NAMED VOLUME read-only into a throwaway alpine to du it from a container view. No host path is involved — docker resolves the volume name daemon-side — so it is the same safe class as the internal/backup/backup.go entry. The gate was right to demand review; this diff is that review, on its own, because burying an allowlist widening inside a feature commit is how an allowlist stops meaning anything. Tooling only: no Go change, no build, no deploy, no version bump.