fix(entrypoint): make /data traversable; hostname gate first (v1.0.0)

Go TempDir bind mounts arrive as 0700; after chown panel:panel, OpenDKIM
could not reach KeyTable and the container crash-looped. chmod 755 /data,
check SELFPOST_HOSTNAME before /data setup, and harden the e2e stand
(restart: no, readiness logs).

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/hostname_gate_test.go

@@ -16,6 +16,11 @@ import (
 func runEntrypoint(t *testing.T, hostnameEnv string) (output string, exitedZero bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	// Entrypoint also chmod 755 /data; mirror that here so a pre-fix image
+	// still gets a traversable bind mount under Go's 0700 TempDir.
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 
 	args := []string{
 		"run", "--rm",
@@ -72,6 +77,9 @@ func TestHostnameGate(t *testing.T) {
 func runEntrypointBackground(t *testing.T, hostnameEnv string) (output string, started bool) {
 	t.Helper()
 	dataDir := t.TempDir()
+	if err := os.Chmod(dataDir, 0o755); err != nil {
+		t.Fatalf("chmod data dir: %v", err)
+	}
 	certDir := t.TempDir()
 	if err := writeSelfSignedCert(certDir+"/fullchain.pem", certDir+"/privkey.pem"); err != nil {
 		t.Fatalf("generate throwaway TLS cert: %v", err)