Judge every path the controller resolves for a directory or file where the plan is composed, so the merge gate refuses a directory in Docker's data (issue 496)

internal/catalogue/dir_into.go

@@ -257,7 +257,10 @@ func dirInto(resource map[string]any, dirs map[string]string, module string) err
 		}
 		resource["env-file"] = filled
 	}
-	return nil
+	// **Placed, then judged** (novox/hq issue 496): the path a directory or file resolves to — the default
+	// layout, a place, a stated path, one beneath a ${dir:…} — is judged here, where every plan and the merge
+	// gate compose it, so a module whose directory lands in Docker's data is refused before it reaches a machine.
+	return judgeResolved(resource, module)
 }
 
 // unknownDirRefs is every ${dir:…} in the definition that names no directory the definition