== RED-PROOF security review 2026-10-18 (box): policyEnv keeps an app-env USERDATA_PATH
    allowlist_test.go:97: an app with no drive kept its own USERDATA_PATH "/mnt/felhom-drives/a/felhom-data/appdata" as a root
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/stacks	0.009s
FAIL

== RED-PROOF security review 2026-10-18 (box): an app named like a mapped folder owns it
    privpolicy_test.go:532: AppdataFolder(paperless) = "paperless" — a template named like paperless-ngx's folder must not own it
    privpolicy_test.go:535: a template named paperless was admitted to paperless-ngx's folder
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-controller/internal/privpolicy	0.005s
FAIL