docs: panel-dkim-signing stage 3 - the documents without OpenDKIM

architecture § OpenDKIM becomes § DKIM signing (keys, the selector table
and when it is rewritten, the two sockets, what is signed and the limits,
the old tree); the process table, start order, liveness, the mail-path
diagram, § Sender check, Persistence and the restore Resync follow the
code. security.md: the panel signs with the login's key, the keys are the
panel's alone, group selfpost and CAP_KILL as they are now; OpenDKIM's
accepted risks go; new ones: what sendmail(1) submits is signed as the
server, Sender: is signed but not judged (the owner's decision), and
go-milter keeps every header per session, so the signer's 1 MiB refusal
does not bound the library's copy. guide: Health, the container log's
dkim-signer lines, backups, the long-line limit, and upgrading to 2.8.0 -
with the rollback to 2.7.x: its start reads the queue as its own postfix
(uid 101) before it hands the queue over, so the hand-over by name is run
in the 2.7.x image first (measured on a copy of the test server's queue:
postsuper failed before, passed after). development, README, SECURITY,
product, the assumptions register's header: what left the image.
entrypoint.sh: a comment, the rollback note as the guide gives it. Plan
stage 3 lines ticked, roadmap 12/14.

Written by four agents, one document each, against a brief of what the
code does; reviewed here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/product.md

@@ -41,8 +41,8 @@ decision:
    are not a current target but not ruled out forever.
 2. **Send from your own IP (DIY)** — no intermediate relay provider. Requires
    outbound port 25, static IP, and configurable PTR/rDNS from the operator.
-3. **Single container** — Postfix, OpenDKIM, and the panel run under one
-   `supervisord` inside one image.
+3. **Single container** — Postfix and the panel, which signs outgoing mail
+   with DKIM itself, run under one `supervisord` inside one image.
 4. **Panel is internet-facing** — mandatory security requirements in
    [security.md](security.md).