release: stamp the image with the release's version (audit H1)

The e2e gate rebuilt selfpost:e2e through compose.override.yml with its
own VERSION=e2e, and that rebuild is the image release.yml pushed: every
published image printed "e2e", and the backup/restore version check
compared a backup's version with "e2e".

- compose.override.yml: VERSION: ${SELFPOST_E2E_VERSION:-e2e}.
- release.yml: the e2e step gets SELFPOST_E2E_VERSION = the release's
  X.Y.Z; a new step before the push checks panel -version and
  selfpost-backup -version of selfpost:e2e against it.
- e2e: image_stamped_with_version checks both binaries against
  expectedVersion() (the variable, or "e2e" when unset).
- development.md, CHANGELOG [Unreleased], audit plan line ticked,
  roadmap 1/61.

Evidence: make e2e on the test server for this tree with
SELFPOST_E2E_VERSION=2.4.2-stamp - exit 0, TestE2E/image_stamped_with_version
PASS, and `docker run --rm --entrypoint <bin> selfpost:e2e -version` prints
2.4.2-stamp for panel and selfpost-backup. GOOS=linux go vet in test/e2e
clean. Published images are left as they are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/compose.override.yml

@@ -28,7 +28,11 @@ services:
       context: ../../..
       dockerfile: build/Dockerfile
       args:
-        VERSION: e2e
+        # release.yml sets SELFPOST_E2E_VERSION to the release's X.Y.Z, so the
+        # image this build tags selfpost:e2e - the one release.yml then pushes -
+        # carries the release's version, not "e2e". A local `make e2e` leaves it
+        # unset. The suite checks the stamp (image_stamped_with_version).
+        VERSION: ${SELFPOST_E2E_VERSION:-e2e}
     image: selfpost:e2e
     environment:
       SELFPOST_HOSTNAME: mail.e2e.test

test/e2e/main_test.go

@@ -130,6 +130,23 @@ func TestE2E(t *testing.T) {
 		}
 	})
 
+	// The image is pushed as the release, so it must say it is the release:
+	// the footer, -version and the backup/restore version check all read this
+	// stamp. Release images were once stamped "e2e" because this stand rebuilt
+	// them with its own VERSION (audit 2026-10-12, H1).
+	run("image_stamped_with_version", func(t *testing.T) {
+		want := expectedVersion()
+		for _, bin := range []string{"panel", "selfpost-backup"} {
+			out, err := h.execIn("selfpost", bin, "-version")
+			if err != nil {
+				t.Fatalf("%s -version: %v", bin, err)
+			}
+			if got := strings.TrimSpace(out); got != want {
+				t.Fatalf("%s -version = %q, want %q", bin, got, want)
+			}
+		}
+	})
+
 	run("setup_and_login", func(t *testing.T) {
 		token, err := readSetupToken(h)
 		if err != nil {

test/e2e/stack.go

@@ -89,6 +89,16 @@ func (s *stack) execIn(service string, args ...string) (string, error) {
 	return string(out), err
 }
 
+// expectedVersion is the version the stand's image is built with: the
+// release's X.Y.Z when release.yml runs the suite, "e2e" for a local run. Its
+// default must stay the default of VERSION in compose.override.yml.
+func expectedVersion() string {
+	if v := os.Getenv("SELFPOST_E2E_VERSION"); v != "" {
+		return v
+	}
+	return "e2e"
+}
+
 func (s *stack) build() error {
 	_, err := s.compose("build")
 	return err