app_generate operates on the manager-owned install template -> runInstallOp (cp/mv/sed); drop sudo on the interactive editor. localDnsApplyPihole edits containers/pihole/.../custom.list (docker-install-owned) -> read via runFileOp, build in a manager /tmp scratch, write back via runFileWrite. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>