base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/postfix/postfix.go

@@ -62,7 +62,7 @@ type Binding struct {
 // a comma-separated list, which is how Postfix expects multiple owners of one
 // sender.
 //
-// Postfix 3.7.11, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch():
+// Postfix 3.10.13, src/smtpd/smtpd_check.c, reject_auth_sender_login_mismatch():
 // the value is split into owners with mystrtok(&cp, CHARS_COMMA_SP).
 func (p *Postfix) RebuildSenderLoginMaps(bindings []Binding) error {
 	content, err := renderSenderLoginMaps(bindings)
@@ -105,7 +105,7 @@ func renderSenderLoginMaps(bindings []Binding) ([]byte, error) {
 		// One line per key as Postfix folds it: smtpd opens the map with
 		// DICT_FLAG_FOLD_FIX and no DICT_FLAG_DUP_* flag, so two keys that
 		// differ only in case would make the whole table unusable (Postfix
-		// 3.7.11, src/util/dict_thash.c, dict_thash_open()). The panel stores
+		// 3.10.13, src/util/dict_thash.c, dict_thash_open()). The panel stores
 		// addresses in lower case already; this keeps the file safe if a row
 		// ever is not.
 		addr := strings.ToLower(b.Address)
@@ -141,7 +141,7 @@ func appendUnique(list []string, v string) []string {
 // and the backslash. A login additionally may not carry "@" — that would make it
 // look like an address.
 //
-// Postfix 3.7.11, src/util/dict_thash.c, dict_thash_open(): the key ends at
+// Postfix 3.10.13, src/util/dict_thash.c, dict_thash_open(): the key ends at
 // the first blank outside quotes, a backslash escapes the next character;
 // src/util/readlline.c: a newline ends the line (one that starts with a blank
 // continues the one before); the owners split on comma and blank (see
@@ -180,7 +180,7 @@ func assertMapSafe(address, login string) error {
 // Arguments are fixed literals — no user input is interpolated into the command,
 // and it never goes through a shell (security.md).
 //
-// Postfix 3.7.11, conf/postfix-script, start-fg: a process that is not PID 1
+// Postfix 3.10.13, conf/postfix-script, start-fg: a process that is not PID 1
 // runs "$daemon_directory/master -s" as its child, and src/master/master.c
 // puts that master in a session of its own (setsid()). "reload" sends the
 // master SIGHUP; src/master/master.c calls master_refresh(), and