docs: panel-dkim-signing stage 3 - the documents without OpenDKIM

architecture § OpenDKIM becomes § DKIM signing (keys, the selector table
and when it is rewritten, the two sockets, what is signed and the limits,
the old tree); the process table, start order, liveness, the mail-path
diagram, § Sender check, Persistence and the restore Resync follow the
code. security.md: the panel signs with the login's key, the keys are the
panel's alone, group selfpost and CAP_KILL as they are now; OpenDKIM's
accepted risks go; new ones: what sendmail(1) submits is signed as the
server, Sender: is signed but not judged (the owner's decision), and
go-milter keeps every header per session, so the signer's 1 MiB refusal
does not bound the library's copy. guide: Health, the container log's
dkim-signer lines, backups, the long-line limit, and upgrading to 2.8.0 -
with the rollback to 2.7.x: its start reads the queue as its own postfix
(uid 101) before it hands the queue over, so the hand-over by name is run
in the 2.7.x image first (measured on a copy of the test server's queue:
postsuper failed before, passed after). development, README, SECURITY,
product, the assumptions register's header: what left the image.
entrypoint.sh: a comment, the rollback note as the guide gives it. Plan
stage 3 lines ticked, roadmap 12/14.

Written by four agents, one document each, against a brief of what the
code does; reviewed here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/entrypoint.sh

@@ -120,8 +120,8 @@ find /data -mindepth 1 -maxdepth 1 ! -name log ! -name postfix ! -name opendkim
 # panel would otherwise make the server's own name a new key, and its
 # published record would no longer match. The selector table is written by
 # the panel before its signer serves (cmd/panel/signer.go). After a rollback
-# to 2.7.x, a domain added there has its key only in the old tree: remove
-# /data/dkim before the next start of 2.8.x to copy again.
+# to 2.7.x, a domain added there has its key only in the old tree: its
+# directory is copied into /data/dkim/keys by hand (guide § Upgrading).
 # (util-linux 2.41, setpriv(1): --reuid, --regid, --clear-groups; cp(1)
 # -P: never follow a symbolic link in the source; chown -R and find never
 # follow one either. GNU chmod keeps a directory's set-group-ID bit under a