build, deploy, inbound, dmarc, backup, e2e: cite the source of what they rely on (assumptions part C)

Comments only, no behaviour changed. Each main.cf/master.cf parameter the
build sets, the wrapper's and the reload hook's reliance on Postfix 3.7.11
(postfix-script, master.5, postconf.5, cleanup_init.c, smtpd_peer.c,
README_FILES), supervisor 4.2.5 (process.py, options.py, events.rst),
logrotate 3.21.0, OpenDKIM's config, Cyrus SASL's sasldb, rspamd 3.11.1
(milter_headers.lua, multimap, the map watcher), Docker Compose, CoreDNS
and certbot now say where that is written. Measurements already there stay
measurements ("date not recorded" where none was); hand-composed fixtures
say so.

Contradictions left for their own commits: C-P31 cleanup's size limit,
C-P42 master outside supervisor's signal, C-V5/V6 startsecs, C-V10,
C-S3/Q3 sasldb written in place, C-Q4/A1 certbot's symlinks, C-R7 rspamd
skips local clients but the signature routine does not, C-P8, C-R4, C-R12,
C-M7, C-E2, C-K8/K9, C-D1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/opendkim.conf

@@ -3,11 +3,16 @@
 # Signing is strictly per-domain: each sending domain has its own key pair and
 # selector. The panel generates keys under /data/opendkim/keys/<domain>/ and
 # keeps KeyTable/SigningTable in sync as domains are added or removed, then asks
-# supervisord to send this process SIGUSR1 to reload the tables.
+# supervisord to send this process SIGUSR1 to reload the tables. (OpenDKIM
+# 2.11.0~beta2, opendkim/opendkim.8.in: on SIGUSR1 the configuration file is
+# re-read; opendkim/opendkim.c, dkimf_config_reload() -> dkimf_config_load(),
+# opens SigningTable and KeyTable again with dkimf_db_open().)
 #
 # Both table files are created (empty) by entrypoint.sh before OpenDKIM starts,
 # so the daemon comes up cleanly on a fresh /data with no domains yet and simply
-# signs nothing until the first domain is added.
+# signs nothing until the first domain is added. (opendkim/opendkim-db.c,
+# dkimf_db_open(): a file or refile table is read line by line; an empty file
+# is an empty table, not an error.)
 
 Syslog                  no
 UMask                   007
@@ -15,15 +20,25 @@ Mode                    s
 
 # SigningTable uses refile: so the "*@example.com" left-hand patterns match any
 # local-part for a domain; KeyTable maps each domain to its key and selector.
+# (opendkim/opendkim.conf.5.in, SigningTable: with "refile" the keys are
+# wildcard patterns matched against the From: address, in file order.)
 KeyTable                /data/opendkim/KeyTable
 SigningTable            refile:/data/opendkim/SigningTable
 
 # The private keys are owned by `panel` and read by `opendkim` through the shared
 # `selfpost` group, so they are deliberately group-readable (mode 0640). That is
 # safe on this single-tenant, private bind mount, but it trips OpenDKIM's default
-# key-safety check, so the check is disabled here by design.
+# key-safety check, so the check is disabled here by design. (opendkim/
+# opendkim.c, dkimf_checkfsnode(): a key file must be owned by root or by the
+# executing uid, and a group-readable one must be in a group of no other user -
+# `panel` owns these and `selfpost` has three members.)
 RequireSafeKeys         no
 
+# UMask 007 above leaves the socket group read-write (opendkim.conf.5.in,
+# UMask: it applies to the socket); its group is selfpost by the setgid
+# /run/opendkim (build/entrypoint.sh). UserID: the process takes the user's
+# groups (opendkim.conf.5.in, UserID); with Background no and -f
+# (build/supervisord.conf, opendkim.8.in) the supervised pid is OpenDKIM itself.
 Socket                  local:/run/opendkim/opendkim.sock
 PidFile                 /run/opendkim/opendkim.pid
 UserID                  opendkim