Preserve PR #3758 source head deec267f07. Correct the static-root policy against tagged upstream 089ec19022f3bb5d87f1e83e30b2034b24f7e77f: current directory and ancestors are rejected, while configured siblings are permitted. Independent EN/JA source review and Markdown lint passed.