security: L8's remaining probe accepted by the owner

Owner, 2026-10-14, asked whether to refuse every foreign address in a
display name to close what L8 leaves (refused or passed still tells an
application which domains are hosted here): "Ответ 1" - leave it. The
probe is a trusted application of this server guessing names one at a
time, as it already had to before L8, when the reply said in words what the
line itself had named. security.md (Mail path and accepted risks, with the
trigger to revisit: untrusted tenants, or the display-name rule decided
anew) and the audit plan record it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -714,8 +714,10 @@ has already run is never edited — the next file is added; the published
    passed list gained capitals, a quoted local part and a name with a space
    after its `@` (passed by design, signed for the own domain). L8 is half
    closed: refused-or-passed still tells an application which domains are
-   hosted here - the owner decides whether to refuse every foreign address
-   in a display name (asked 2026-10-14).
+   hosted here. *Owner, 2026-10-14: leave it* - the probe is a trusted
+   application's guess, one name at a time, as before L8; refusing every
+   foreign address in a display name is not wanted (security.md, accepted
+   risks).
    *Done 2026-10-14:* fifteen lines (`internal/milter/testdata/from-lines-passed.txt`),
    each signed for the application's domain alone, the signature valid. No
    disagreement. Groups are refused by the check, so none is in the file;