== catalog gate red-proof: the allow-list check never refuses
  XX  FACT: privileged true                                                  rc=0 (expected 1)
  XX  FACT: cap_add                                                          rc=0 (expected 1)
  XX  FACT: the host root bound                                              rc=0 (expected 1)
  XX  FACT: a bind through another variable                                  rc=0 (expected 1)
  XX  FACT: homepage's socket READ-WRITE                                     rc=0 (expected 1)
  XX  FACT: the allowed socket in ANOTHER app                                rc=0 (expected 1)
  XX  FACT: network_mode host                                                rc=0 (expected 1)
  XX  FACT: a driver_opts bind volume                                        rc=0 (expected 1)
  XX  FACT: a ${VAR} in a privileged key                                     rc=0 (expected 1)
  XX  FACT: privileged in a steps/ file                                      rc=0 (expected 1)
fails: 10
== restored
check-privileges: 123 files judged, every class-setting on the allow-list
