base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap.md

@@ -825,8 +825,9 @@ attention to 3.10's reject logging (`sasl_method`, `sasl_username`,
 cleanup's `canceled` line, 3.8's `postfix(1)` stderr logging under
 supervisord; `dev/upstream` refetched from trixie; the cited-package table
 and `checkCitedPackageVersions`; the e2e sink image; `opendkim-tools`
-dropped from the image (used by nothing at run time). OpenDKIM's code is
-the same in trixie, its citations stand. One stage, a MINOR release. Also
+dropped from the image (used by nothing at run time). OpenDKIM's signing
+and From:-parsing code is the same in trixie (its new Debian patches touch
+the verifier and librbl), its citations stand. One stage, a MINOR release. Also
 gained: `smtpd_hide_client_session` (3.10); the owner decided on
 2026-10-15 to turn it on for 465 and 587 in the same release, so the
 `Received:` header no longer shows the application's address.