cert-reload: renew Postfix's copy of a renewed certificate (audit H2)

postfix-config.sh copies the mounted certificate and key into
/etc/postfix/tls-internal at start (root-owned, key 0600) and Postfix reads
the copy; cert-reload only ran `postfix reload` daily, which re-read the
stale copy, so a certificate renewed while the container ran expired on
465/587 with the old one.

postfix-cert-reload.sh now, every TLS_RELOAD_INTERVAL_SECONDS: compares the
mount with the copy (cmp); when they differ and the certificate and key
belong together (openssl public keys equal - a renewer writes them one
after the other), writes each file beside its target, root-owned with the
start's modes, renames it over the target, and reloads Postfix. Nothing
changed - no reload. No copy (files missing at start) - the old periodic
reload. Never exits non-zero.

e2e renewed_certificate_picked_up: writes a new certificate into the
stand's mount and waits (30 s) for port 465 to present its serial;
compose.override.yml sets TLS_RELOAD_INTERVAL_SECONDS=2.
supervisord.conf comment, architecture.md (process table, § Postfix TLS
certs, the env knob), guide (after the proxies: picked up within a day).
CHANGELOG [Unreleased], audit plan line ticked, roadmap 12/61.

Evidence: GOOS=linux go vet in test/e2e clean; the server run of the stage
follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -629,7 +629,7 @@ has already run is never edited — the next file is added; the published
    priority follows `tailer_blind_seconds`.
 - [x] **Anchor `deliveryRe`** at the head of the line like its two siblings;
    test with the probed HELO and quoted-sender lines. — **Opus**
-- [ ] **TLS re-copy** (H2): `postfix-cert-reload.sh` compares the mounted files
+- [x] **TLS re-copy** (H2): `postfix-cert-reload.sh` compares the mounted files
    to the copy and re-copies before `postfix reload` (atomically, same modes);
    e2e replaces the cert in the stand and reads the new serial off 465.
    — **Opus**