base-trixie: the image on Debian trixie, Postfix 3.10.13; Received: hidden on 465/587

The runtime base is debian:trixie-slim, the build stage golang:1.26-trixie:
Postfix 3.10.13 with upstream's 2026 security fixes up to the August
batch, libmilter 8.18.1, OpenSSL 3.5. Every citation of another program in
code, scripts and documents was re-read against the trixie sources
(dev/upstream; bookworm's kept in dev/upstream-bookworm) and updated;
development.md's cited-package table holds the trixie versions.

What the re-reading changed in behaviour:
- logtail: reject lines with sasl_method/sasl_username/sasl_sender
  (smtpd_check.c:1019-1026); cleanup's "removed (canceled)" forgets a
  port-25 id (cleanup_api.c:363-364).
- internal/postfix/retry.go reads postconf's stdout only: since 3.9 a
  deprecated-parameter warning on stderr made one value too many and the
  panel fell back to the compiled-in retry policy.
- logrotate-loop.sh: logrotate 3.22 exits 1 when it ignores a config;
  the loop refuses on that output whatever the status.
- postfix-config.sh: cyrus_sasl_config_path set explicitly (bookworm's
  07_sasl_config.diff is gone); maillog_file_permissions=0640; mynetworks
  explicit; Dockerfile: SYNC_CHROOT= in /etc/default/postfix,
  opendkim-tools dropped, openssl named, systemd-standalone-sysusers so
  cron does not bring the whole of systemd.
- The selfpost group is 10998, outside the system range 100-999: in
  trixie a package took 998 and the build failed (owner's decision:
  a conflict-free id, the distribution's own ids untouched). The
  entrypoint hands /data back by name when the user or the group differs.
  Guide, backup refusal text, help (design commit 68ec8b2), e2e.
- smtpd_hide_client_session=yes on smtps and submission (owner's
  decision): Received: names no client, TLS, login or protocol; port 25
  keeps the full header. e2e checks both.
- test/upstream/opendkim-probe.sh makes keys with openssl genrsa.

Tests: on the server, make e2e exit 0 (674 s, the image built on trixie),
go vet + go test 27 packages ok. CHANGELOG [Unreleased], guide,
architecture.md, security.md, roadmap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/delivery_log_test.go

@@ -55,7 +55,7 @@ func testDeliveryLogSurvivesRotation(t *testing.T, sc *scenario) {
 
 	// The rotation ends with `postfix reload`, which fails while Postfix is
 	// still starting - and this step follows one that restarts the container.
-	// (Postfix 3.7.11, conf/postfix-script: "reload" and "status" both test
+	// (Postfix 3.10.13, conf/postfix-script: "reload" and "status" both test
 	// "master -t" and exit 1 while master does not hold its pid lock.)
 	if err := waitFor("Postfix to be running", 30*time.Second, 500*time.Millisecond, func() (bool, error) {
 		if _, err := h.execIn("selfpost", "postfix", "status"); err != nil {
@@ -82,7 +82,7 @@ func testDeliveryLogSurvivesRotation(t *testing.T, sc *scenario) {
 // testExpiredMessageIsClosed: a message Postfix gives up on is closed as
 // bounced. Postfix logs expiry once per message, "<id>: from=<..>,
 // status=expired, returned to sender" (here "force-expired"), and no line per
-// recipient (Postfix 3.7.11, src/qmgr/qmgr_active.c,
+// recipient (Postfix 3.10.13, src/qmgr/qmgr_active.c,
 // qmgr_active_done_25_generic(); assumptions A-8). The queue lifetime cannot
 // be waited out, so the message is deferred by hand - defer_transports=smtp,
 // under which qmgr hands the recipient to the retry service, "4.3.2 deferred
@@ -154,7 +154,7 @@ print("" if r is None else r[0]+" "+r[1])`, token)
 // testRecipientsAsPostfixLogsThem: each recipient's row reaches "sent". The
 // row holds the recipient as Postfix logs it - "a b" stays quoted, "ab" loses
 // its quotes - and a recipient given again in other capitals is one row, as
-// cleanup keeps one (Postfix 3.7.11, src/global/quote_822_local.c,
+// cleanup keeps one (Postfix 3.10.13, src/global/quote_822_local.c,
 // src/cleanup/cleanup_out_recipient.c; assumptions B-G5, A-31). Before, the
 // first was cut at its blank and its row closed as bounced by the sweep.
 func testRecipientsAsPostfixLogsThem(t *testing.T, sc *scenario) {
@@ -184,7 +184,7 @@ print("; ".join(r[0]+" "+r[1] for r in rows))`, token)
 
 // testAddressLiteralIsNotLocal: an address literal of an interface the
 // container listens on is a local destination to Postfix even with an empty
-// mydestination (Postfix 3.7.11, src/global/resolve_local.c,
+// mydestination (Postfix 3.10.13, src/global/resolve_local.c,
 // resolve_local()). Local delivery is Postfix's refusal now
 // (local_transport=error:..., assumptions C-P8), and smtpd refuses such a
 // recipient at RCPT with its text: smtpd_reject_unlisted_recipient (on by