fix(postfix): root-own TLS copies for postfix check

CI showed postfix check failing after all postconf stages with the key owned
by host UID 1001 on a :ro mount. Copy cert/key into /etc/postfix/tls-internal
as root:root mode 644/600 before configuring Postfix; keep step logs for
verification.

Co-Authored-By: Composer <noreply@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -5,6 +5,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Fixed
+
+- Postfix config: copy TLS cert/key from the (often `:ro`, host-owned) mount
+  into `/etc/postfix/tls-internal` as `root:root` before `postconf` /
+  `postfix check`. Bind-mounted keys owned by the CI/host UID made
+  `postfix check` fail and the container exit before supervisord started.
+
 ## [1.0.0] - 2026-08-09
 
 ### Added