release: 2.5.0: audit stages 1 and 2 - the delivery log and the tenant boundary

Stage 1: a cut queue listing no longer bounces held mail; the reconcile
sweep closes only queued rows, by id, marked "reconcile", and its fate is
measured (delivery_log_days, migration 0007); delivery lines are read at
the head of the line; a renewed TLS certificate is served without a
restart; Health counts the message a hung panel deferred.
Stage 2: logins folded to lower case and unique without regard to case;
the last global administrator kept inside the transaction, users saved
whole; a domain import held to the forms' rules; log rows by domain id
(migration 0008); the 550 reply names no other domain; which key OpenDKIM
signs with, tested. Plus the findings of both reviews of each stage.

Rolled out to the test server as 2.4.2-post.ef18ef2 (the same code):
migrations 0007 and 0008 ran on the live database - schema 8, 68/68 send-log
and 10/10 inbound rows tied to their domain, integrity ok.

CHANGELOG cut; pin 2.5.0 in deploy/docker-compose.yml, README (with the
local-build note), guide; development.md "from pin"; roadmap row and the
recommended order; stages 1 and 2 marked shipped in the plan. No tag (the
owner's command only).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -596,7 +596,7 @@ has already run is never edited — the next file is added; the published
    port 25 holds `554 … Relay access denied`), `550 5.1.1` (port 25 unknown
    recipients), any `4xx` reply (panel down).
 
-### Stage 1 — mail that is shown wrong (H3, H2, M12, M13) → `2.5.0`
+### Stage 1 — mail that is shown wrong (H3, H2, M12, M13) → `2.5.0` (shipped 2026-10-14)
 
 - [x] **`QueueIDs` on a truncated listing returns an error**, as `postqueueJSON`
    does; `reconcile` already treats an error as no information. Test: a 5 MiB
@@ -654,7 +654,7 @@ has already run is never edited — the next file is added; the published
    the rule), § Sender check "what it costs"; guide § Delivery log, § Health.
    — **Sonnet**
 
-### Stage 2 — the tenant boundary and the registry (H4, M7, M9, M10) → in `2.5.0` (migration `0008`)
+### Stage 2 — the tenant boundary and the registry (H4, M7, M9, M10) → in `2.5.0` (migration `0008`; shipped 2026-10-14)
 
 - [x] **Logins lower-cased** at validation (owner, 2026-10-12: fold, do not
    refuse) and `applications.login COLLATE NOCASE` (migration `0008` rebuilds