logtail: Inbound log takes Postfix's own tail, not a recipient's (audit M2)

Security audit 2026-10-17, finding M2, stage 0 - proven on the live server:
Postfix quotes a refused recipient in its reply in internal form (quotes
removed, "; < > =" kept: extract_addr, tok822_internalize), so
RCPT TO:<"; from=<ceo@…> to=<board@…> proto=ESMTP helo=<x>; "@domain>
spelled a whole tail inside the reply, and inboundRejectRe, whose reply
ended at the FIRST "; from=<", took the stranger's sender, recipient and
inbound domain for the row.

Now the reply is greedy and the tail anchored: "; from=<…> to=<…>
proto=\S+", a HELO name holding none of Postfix's NEUTER_CHARACTERS
(smtpd.c:1634, helo_cmd neuters ` <>()\";@`), and one-word SASL fields to
the end of the line (a `.*` SASL tail would have let a quoted MAIL FROM
spell the whole tail). Belt and braces: a reply that still holds
"; from=<" - a line with two tails - makes no row, so neither a recipient
nor an un-neutered HELO name can choose one. The quote/bracket/space
filter on from/to stays.

Tests: TestInboundRecipientCannotWriteTheRow (the live line's shape, and
with a forged MAIL FROM too); TestInboundHeloCannotWriteTheRow now feeds
HELO names as Postfix logs them (neutered) and expects no row for the
un-neutered ones. go test ./internal/logtail on Windows (the three known
Windows-only Follow failures aside).

Docs: security.md § Mail path; CHANGELOG; plan line ticked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -441,10 +441,17 @@ operator can act on it.
   The signature goes on to the upstream with the mail and is of no use there:
   it fits one queue id. Refusals are
   parsed from `mail.log` from the head of the line, with the reply ending at
-  Postfix's own `; from=<` so that the HELO name after it - the client's text,
-  which Postfix logs with non-printable characters and ` <>()\";@` turned into
-  `?` (Postfix 3.10.13, src/smtpd/smtpd.c `helo_cmd()`) - cannot stand in for
-  the sender, the recipient or the reply; an address with a quote, a bracket or a space in it is not kept.
+  the *last* `; from=<…> to=<…> proto=…` that runs to the end of the line.
+  That tail is Postfix's own: the HELO name in it is logged with
+  non-printable characters and ` <>()\";@` turned into `?` (Postfix 3.10.13,
+  src/smtpd/smtpd.c `helo_cmd()`), and the pattern takes none of them there;
+  a refused recipient, which the reply quotes with its quotes removed and
+  `; < > =` kept, can spell such a tail only inside a quoted local part,
+  whose quote then lands in what would be the sender or the recipient - and
+  an address with a quote, a bracket or a space in it is not kept. A line
+  whose reply still holds `; from=<` - two tails - makes no row. (Until
+  `2.14.4` the reply ended at the *first* `; from=<`, which a stranger's
+  recipient could supply - security audit 2026-10-17, M2.)
   Only a recipient at an inbound domain makes a row. The journal is cut to
   10 000 rows every 500 rows the tailer writes, and by age every six hours.
 - **Filter lists** reach another container as files: values are whitelisted on