fix: contain file-explorer binds into Sencho's system directories (#1484)

The file-explorer root containment treated only kernel and OS-state paths
(/etc, /proc, /sys, /dev, /run, /var/run) as dangerous. System locations
that hold the executables and libraries Sencho's own runtime depends on,
notably /usr (which contains /usr/local/bin/node, the docker CLI, and the
entrypoint) plus /bin, /sbin, /lib, /lib64, /boot and /root, were left
browsable, writable and chmodable.

A stack author with stack:edit could declare one of these as a bind source,
overwrite a binary, and have a later deploy execute it. Add those locations
to the dangerous-root set so such a bind is never browsable or editable; the
boundary check still permits ordinary host paths whose name merely prefixes a
protected root (for example /usrdata).

backend/src/services/StackFileRootsService.ts

@@ -105,9 +105,20 @@ export function stackSourceFileRoot(hostPathOrName = ''): StackFileRoot {
 const ROOTS_CACHE_TTL_MS = 15_000;
 
 // Dangerous host directories: a bind equal to or under any of these grants
-// node-level access and is never browsable. The docker socket is caught
-// separately via isDockerSocketMount on the declared source.
-const DANGEROUS_ROOTS = ['/etc', '/proc', '/sys', '/dev', '/var/run', '/run'];
+// node-level access and is never browsable. Two groups:
+//   - kernel/OS state: /etc, /proc, /sys, /dev, /var/run, /run.
+//   - the system locations holding the executables and libraries Sencho's own
+//     runtime depends on: /usr (which contains /usr/local/bin/{node,docker,npm}
+//     and /usr/local/lib), /bin, /sbin, /lib, /lib64 (the base-image binaries),
+//     plus /boot and /root. A stack author with stack:edit must not be able to
+//     declare one of these as a bind source, overwrite a binary, and have a
+//     later deploy execute it.
+// The docker socket is caught separately via isDockerSocketMount on the
+// declared source.
+const DANGEROUS_ROOTS = [
+  '/etc', '/proc', '/sys', '/dev', '/var/run', '/run',
+  '/usr', '/bin', '/sbin', '/lib', '/lib64', '/boot', '/root',
+];
 
 interface CacheEntry {
   roots: StackFileRoot[];