== red-proof 1: guard disabled (refusal returns nil)
=== RUN   TestR650_RealDockerIsRefusedUnderGoTest
    dockerexec_test.go:22: docker: want an R-650 refusal naming the command, got <nil>
--- FAIL: TestR650_RealDockerIsRefusedUnderGoTest (0.06s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec	0.067s
FAIL
== red-proof 2: one bare call site put back (dbdump.go)
=== RUN   TestR650_NoBareDockerExec
        ../../internal/appbackup/dbdump.go:140: cmd := exec.CommandContext(ctx, "docker", "ps", "--format",
--- FAIL: TestR650_NoBareDockerExec (0.16s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec	0.165s
FAIL
== restored
ok  	gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec	0.177s
 1 file changed, 12 insertions(+), 11 deletions(-)
