ci: actions by commit, govulncheck, images pinned, base packages watched (audit I4, I5)

Security audit 2026-10-17, findings I4 and I5 (low), stage 5.

I4: every action is pinned by commit with its version in a comment - the
latest release of the major each used, so nothing changes in behaviour
(checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0,
build-push-action v6.19.2, login-action v3.7.0; commits read with git
ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the
source in test.yml, and in release.yml on the image's panel and
selfpost-backup binaries before the push (-mode=binary: the base image's
Go, which may lag the runner's - a fixed stdlib advisory then fails the
release until golang:1.26-trixie moves, which is the point). certbot is
pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17).
provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the
plan says.

I5: published tags are never rebuilt, so a Debian security fix reaches
operators with the next release. The guide (§ Upgrading) and SECURITY.md
say so; base-packages.yml runs .github/scripts/base-packages.sh every
Monday: what debian:trixie-slim would install for postfix, libsasl2-2,
libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against
the table in development.md (the 2.14.3 image's versions), red when one
moved. Tried on the test server: green as it stands, red with a version
changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/caddy/docker-compose.caddy.yml

@@ -16,7 +16,8 @@
 # the CA URL's host and path, "acme-v02.api.letsencrypt.org-directory" for Let's
 # Encrypt). caddy/modules/caddytls/automation.go, DefaultIssuers(): ZeroSSL is a
 # second issuer only when an email is configured, and the Caddyfile below sets
-# none. Read at the projects' master of 2026-10-14: `caddy:2` is a moving tag.
+# none. Read at the projects' master of 2026-10-14, when the image was the
+# moving `caddy:2`; it is pinned below now, and a bump re-reads these.
 #
 # Merge with the base file — run this from the deploy/ directory (Compose
 # resolves every relative path in both files against the directory of the
@@ -46,7 +47,9 @@ services:
       - ./caddy/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<hostname>:/etc/postfix/tls:ro
 
   caddy:
-    image: caddy:2
+    # Pinned to a release: "2" moves under a running server (security audit
+    # 2026-10-17, I4). Bump it deliberately.
+    image: caddy:2.11.7
     restart: unless-stopped
     # A ceiling on processes and threads (security audit 2026-10-17, I3).
     pids_limit: 256

deploy/nginx/docker-compose.nginx.yml

@@ -60,7 +60,9 @@ services:
       - ./nginx/certbot-www:/var/www/certbot:ro
 
   certbot:
-    image: certbot/certbot:latest
+    # Pinned like every image here: "latest" moves under a running server
+    # (security audit 2026-10-17, I4). Bump it deliberately.
+    image: certbot/certbot:v5.8.0
     pids_limit: 64
     volumes:
       - ./nginx/certbot-etc:/etc/letsencrypt