entrypoint: /data/opendkim removed, as planned for the release after 2.8.0

2.8.x copied the keys from /data/opendkim to /data/dkim and kept the old
tree for a rollback to 2.7.x "until the next release"
(docs/plans/panel-dkim-signing.md, Q2); the owner's "потом режь 2.9.0"
(2026-10-16) makes this that release. The entrypoint now removes the tree
once /data/dkim holds a key, and says so. A /data with keys under the
old tree only - one that never ran 2.8.x - stops the start with a message
to run 2.8.x first, rather than let the panel give the server's own name
a new key its published record would not match; the tree is left as it
was. Gone with it: the copy into /data/dkim.new, the tree's
normalisation, its exemption from the general hand-over, its key link in
drop_links, and the backup's exclusion of "opendkim" (dead: the panel
never sees the tree now).

Tests: e2e TestStartsOnA28Data replaces TestStartsOnA27Data - a /data as
2.8.x left it (both trees, a queue of foreign uids, a rotation due): the
old tree is gone, the key under /data/dkim is the one left, the selector
table names it, the queue is Postfix's by name; TestRefusesA27Data - the
start stops, says why, leaves the old key and makes no new one. go vet +
go test (26 packages) and make e2e (all pass) on the test server for this
tree.

Docs: guide § Upgrading "To 2.9.0" (rollback to 2.8.x needs nothing, to
2.7.x only from a 2.7.x backup; the 2.7.x rollback paragraph says it is
for 2.8.x only and keeps naming 2.7.0), guide § backup, architecture
(the old tree, § Persistence's table and the restore line), security
§ Backup, development's e2e paragraph, the plan's key step; CHANGELOG
[Unreleased] § Removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -410,11 +410,10 @@ operator can act on it.
   private key from `certs/` when present; a domain export carries the DKIM key
   and **working** application passwords in the clear (otherwise a transfer
   without recreating credentials would be impossible). The keys a backup
-  carries are those of `/data/dkim`; `/data/opendkim`, the tree 2.7.x read
-  and kept for a rollback, is left out (`internal/backup`,
-  `excludedFromArchive`, `2.8.0`): an archive restores into its own version
-  alone, and a second copy of every key - one that outlives a deleted
-  domain's - has no place in it.
+  carries are those of `/data/dkim`. `/data/opendkim`, the tree 2.7.x read,
+  was left out while 2.8.x kept it for a rollback (`2.8.0`); since `2.9.0`
+  the entrypoint removes it before the panel starts, so no second copy of
+  every key - one that outlived a deleted domain's - is left on disk.
 - Links under `certs/` (and `certs` itself as a link) are followed, in the
   container's view: the archive carries whatever regular file they lead to
   that the panel's user may read. `certs/` is the operator's, mounted