fix(entrypoint): make /data traversable; hostname gate first (v1.0.0)

Go TempDir bind mounts arrive as 0700; after chown panel:panel, OpenDKIM
could not reach KeyTable and the container crash-looped. chmod 755 /data,
check SELFPOST_HOSTNAME before /data setup, and harden the e2e stand
(restart: no, readiness logs).

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/compose.override.yml

@@ -16,6 +16,10 @@
 
 services:
   selfpost:
+    # Crash-looping with unless-stopped makes `compose exec` fail with
+    # "Container is restarting" and hides the entrypoint/supervisord exit
+    # reason; keep the stand exited so logs stay attached to one attempt.
+    restart: "no"
     build:
       # Resolved relative to --project-directory (.stage), NOT this file's own
       # directory — compose build.context paths follow the project directory,

test/e2e/hostname_gate_test.go

@@ -16,6 +16,11 @@ import (
 func runEntrypoint(t *testing.T, hostnameEnv string) (output string, exitedZero bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	// Entrypoint also chmod 755 /data; mirror that here so a pre-fix image
+	// still gets a traversable bind mount under Go's 0700 TempDir.
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 
 	args := []string{
 		"run", "--rm",
@@ -72,6 +77,9 @@ func TestHostnameGate(t *testing.T) {
 func runEntrypointBackground(t *testing.T, hostnameEnv string) (output string, started bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 	certDir := t.TempDir()
 	if err := writeSelfSignedCert(certDir+"/fullchain.pem", certDir+"/privkey.pem"); err != nil {
 		t.Fatalf("generate throwaway TLS cert: %v", err)

test/e2e/process_check.go

@@ -45,7 +45,10 @@ func checkSupervisorProcesses(s *stack) error {
 		}
 		return true, nil
 	})
-	return err
+	if err != nil {
+		return fmt.Errorf("%w\n==== selfpost logs ====\n%s", err, s.logs("selfpost"))
+	}
+	return nil
 }
 
 func parseSupervisorStatus(out string) map[string]string {