base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/Dockerfile

@@ -85,10 +85,14 @@ RUN echo "postfix postfix/mailname string localhost" | debconf-set-selections \
 # it off (debian/configure-instance.in:22-24 and :44; debian/README.Debian:136-138).
 RUN printf 'SYNC_CHROOT=\n' > /etc/default/postfix
 
-# Unprivileged user for the panel process. Its ids are left to useradd: the
-# entrypoint gives /data back to it by name on every start, so a number
-# that differs from one image to the next changes nothing.
-RUN useradd --system --no-create-home --shell /usr/sbin/nologin panel
+# Unprivileged user for the panel process, with ids of its own outside the
+# system range for the same reason as selfpost's below: its files under
+# /data show on the host by number, and a number from that range is a
+# system group of the host's too (useradd gave the panel group 998 in the
+# trixie image, systemd-network on the test server's host; bookworm's
+# 999:999 was the host's systemd-journal group). The entrypoint gives /data
+# back to it by name on every start, so files of the old ids follow.
+RUN groupadd --system --gid 10999 panel  && useradd --system --uid 10999 --gid panel --no-create-home --shell /usr/sbin/nologin panel
 
 # Shared group bridging the unprivileged services: the panel generates
 # per-domain DKIM keys, application SASL accounts (sasldb2) and the Postfix