antispam: rspamd strips a sender's own verdict for every client

rspamd 3.11.1's milter_headers skips its verdict routines - removes none
of the sender's X-Spamd-Result / X-Rspamd-Action, adds none - for a client
it counts as local (loopback, a unix socket, local_addrs: the private
ranges) or one that authenticated (skip_local, skip_authenticated, both on
by default; milter_headers.lua skip_wanted(), lua_ip.c lua_ip_is_local()).
The custom routine that signs X-SelfPost-Filter is never put through
skip_wanted(), so it signed the sender's own verdict, and Inbound > Log
showed it as rspamd's. Every sender is private when Docker's proxy relays
port 25 from the bridge gateway. Both options set to false.

Tried 2026-10-14 in a throwaway rspamd/rspamd:3.11.1-3 on the test server
(rspamc --ucl, a message carrying its own verdict headers): old config,
from 10.0.0.5 and as an authenticated user, the milter reply removed and
added neither and added the signature; new config, both removed and
rspamd's own added, as from 203.0.113.9.

Also: the sender rules take the envelope only (extract_from = "smtp"; by
default a bounce's From: header is used - tried: a bounce whose From:
domain is denied was refused before, is not now; a denied sender is
refused either way); the image pinned to 3.11.1-3, the build read (3.11 and
3.11.1 move with each rebuild); the prefilter lines no longer read go.
architecture.md and security.md say so. Assumptions C-R7, B-R1, C-R4,
C-R12, C-R5.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/antispam/docker-compose.antispam.yml

@@ -9,8 +9,10 @@
 # Requires INBOUND_RELAY_ENABLE=true in .env. The milter sees the real client
 # IP, HELO and PTR — unlike the upstream, which only sees SelfPost's address.
 #
-# Pin the rspamd tag the same way the SelfPost image is pinned; bump it
-# deliberately. Default milter action is fail-open (accept) so a down sidecar
+# The rspamd image is pinned to one build, 3.11.1-3 - "3.11" and "3.11.1"
+# move with each rebuild (Docker Hub rspamd/rspamd tags 3.11.1-0 ... -3) -
+# and it is the build the comments in antispam/rspamd/ were read against;
+# bump it deliberately, and read them again. Default milter action is fail-open (accept) so a down sidecar
 # does not block backup-MX. Set INBOUND_ANTISPAM_MILTER_ACTION=tempfail to
 # defer instead.
 
@@ -28,7 +30,7 @@ services:
     # rspamd_proxy worker, which the image binds to *:11332 (rspamd-docker
     # v3.11.1+3, patches/rspamd-docker-config.diff), and runs as uid 11333
     # (its Dockerfile, USER 11333:11333).
-    image: rspamd/rspamd:3.11
+    image: rspamd/rspamd:3.11.1-3
     restart: unless-stopped
     # No host ports: only SelfPost talks to the milter on the compose network.
     volumes: