release: stamp the image with the release's version (audit H1)

The e2e gate rebuilt selfpost:e2e through compose.override.yml with its
own VERSION=e2e, and that rebuild is the image release.yml pushed: every
published image printed "e2e", and the backup/restore version check
compared a backup's version with "e2e".

- compose.override.yml: VERSION: ${SELFPOST_E2E_VERSION:-e2e}.
- release.yml: the e2e step gets SELFPOST_E2E_VERSION = the release's
  X.Y.Z; a new step before the push checks panel -version and
  selfpost-backup -version of selfpost:e2e against it.
- e2e: image_stamped_with_version checks both binaries against
  expectedVersion() (the variable, or "e2e" when unset).
- development.md, CHANGELOG [Unreleased], audit plan line ticked,
  roadmap 1/61.

Evidence: make e2e on the test server for this tree with
SELFPOST_E2E_VERSION=2.4.2-stamp - exit 0, TestE2E/image_stamped_with_version
PASS, and `docker run --rm --entrypoint <bin> selfpost:e2e -version` prints
2.4.2-stamp for panel and selfpost-backup. GOOS=linux go vet in test/e2e
clean. Published images are left as they are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -89,8 +89,27 @@ jobs:
           cache-dependency-path: test/e2e/go.sum
 
       - name: e2e (gates publishing — see docs/development.md)
+        # The e2e builds selfpost:e2e again through compose.override.yml, and
+        # that rebuild is the image pushed below. Without the version here it
+        # was stamped "e2e" (audit 2026-10-12, H1); the suite now checks the
+        # stamp against this variable.
+        env:
+          SELFPOST_E2E_VERSION: ${{ needs.prepare.outputs.version }}
         run: cd test/e2e && go test -v -timeout 20m ./...
 
+      - name: Check the version stamp of the image about to be pushed
+        env:
+          WANT: ${{ needs.prepare.outputs.version }}
+        run: |
+          set -euo pipefail
+          for bin in panel selfpost-backup; do
+            got=$(docker run --rm --entrypoint "$bin" selfpost:e2e -version)
+            if [ "$got" != "$WANT" ]; then
+              echo "::error::selfpost:e2e $bin -version = '$got', want '$WANT'; refusing to push"
+              exit 1
+            fi
+          done
+
       - name: Log in to ghcr.io
         uses: docker/login-action@v3
         with: