test(e2e): entrypoint ERR trap and richer CI failure logs

CI showed exit=1 in ~3s with empty docker logs after /data/opendkim was
created. Log each entrypoint step and trap ERR with LINENO; also read the
container LogPath and docker logs by container id when compose logs are empty.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/entrypoint.sh

@@ -6,6 +6,12 @@
 # looks like a permissions or packaging problem (and so the e2e hostname-gate
 # tests see the FATAL text rather than an earlier set -e abort).
 set -e
+# #region agent log
+# Debug: CI showed exit=1 with empty docker logs after /data/opendkim was
+# created — surface the failing line under set -e (session 816647).
+trap 'echo "entrypoint: command failed at line $LINENO (exit $?)" >&2' ERR
+step() { echo "entrypoint: $*" >&2; }
+# #endregion
 
 # SELFPOST_HOSTNAME is an identity, not a setting with a safe default: it must
 # simultaneously match the PTR/rDNS record, the certificate CN/SAN, and the
@@ -62,6 +68,7 @@ esac
 # trees under /data as other users. Go's testing.TempDir is 0700, and a bare
 # chown would leave that mode in place — opendkim then cannot read KeyTable and
 # the container crash-loops (e2e TestHostnameGate/valid_hostname_starts).
+step "chown/chmod /data"
 chown panel:panel /data
 chmod 755 /data
 # Restored backups or previously-created state may contain panel-owned files
@@ -69,6 +76,7 @@ chmod 755 /data
 # later phase deliberately hands to another service. /data/log is exempt: it is
 # deliberately owned by postfix (postlogd writes the delivery log there) and is
 # normalised on its own below.
+step "normalize existing /data children"
 find /data -mindepth 1 -maxdepth 1 ! -user panel ! -name log -exec chown -R panel:panel {} +
 
 # DKIM key tree (spec 6, 9). The panel (user `panel`) generates keys and writes
@@ -80,6 +88,7 @@ find /data -mindepth 1 -maxdepth 1 ! -user panel ! -name log -exec chown -R pane
 #   - private keys and tables group-readable (0640);
 #   - both table files present (empty is fine) BEFORE OpenDKIM starts, so the
 #     daemon comes up cleanly with no domains yet.
+step "opendkim tree"
 mkdir -p /data/opendkim/keys
 for t in /data/opendkim/KeyTable /data/opendkim/SigningTable; do
 	[ -e "$t" ] || : > "$t"
@@ -94,6 +103,7 @@ find /data/opendkim/keys -type f -name '*.private' -exec chmod 0640 {} +
 # clients. Share it through the `selfpost` group the same way as the DKIM tree:
 # setgid directory so new files inherit the group, and the database itself
 # group-readable (0640).
+step "sasl tree"
 mkdir -p /data/sasl
 chown -R panel:selfpost /data/sasl
 chmod 2750 /data/sasl
@@ -102,6 +112,7 @@ chmod 2750 /data/sasl
 # Postfix sender_login_maps (spec 5.1). The panel writes it; Postfix reads it.
 # Ensure the file exists (empty is fine) before Postfix starts so a reload that
 # references it never fails on a missing file, and keep it group-readable.
+step "postfix sender map"
 mkdir -p /data/postfix
 [ -e /data/postfix/sender_login_maps ] || : > /data/postfix/sender_login_maps
 chown -R panel:selfpost /data/postfix
@@ -119,6 +130,7 @@ chmod 0640 /data/postfix/sender_login_maps
 # directory keeps the shared group on anything created inside it later, and
 # 2750 keeps it group-traversable but not group-writable — logrotate refuses to
 # rotate a log whose directory is writable by a non-root group.
+step "mail.log tree"
 mkdir -p /data/log
 [ -e /data/log/mail.log ] || : > /data/log/mail.log
 chown -R postfix:selfpost /data/log
@@ -133,6 +145,7 @@ find /data/log -type f -exec chmod 0640 {} +
 # each socket created inside inherits group `selfpost`, and group-traversable
 # (2750) lets postfix reach it. Without this, smtpd cannot talk to OpenDKIM and,
 # because signing is strict (default_action=tempfail), rejects all mail.
+step "milter run dirs"
 mkdir -p /run/opendkim /run/selfpost
 chown opendkim:selfpost /run/opendkim
 chown panel:selfpost /run/selfpost
@@ -142,6 +155,8 @@ chmod 2750 /run/opendkim /run/selfpost
 # 5). Kept out of the image build so cert paths, rate limits, hostname and the
 # optional 587 service are all driven by env at run time, and re-derived on every
 # start the same way the /data normalisation above is.
+step "postfix-config.sh"
 /usr/local/bin/postfix-config.sh
 
+step "exec supervisord"
 exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf