base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/app/sasl.go

@@ -309,11 +309,17 @@ func runSaslpasswd2(args []string, stdin []byte) error {
 // dumpSASLDB runs db_dump to export the sasldb2 as key/value hex pairs. The path
 // is our own sasldb2 file (never user input) and is passed as a fixed argument
 // with no shell (security.md).
+//
+// Only standard output is the dump: a message db_dump writes to standard
+// error is not data and is left out of what is parsed (the same rule as
+// postconf's values in internal/postfix, retry.go; review of base-trixie).
 func dumpSASLDB(path string) ([]byte, error) {
 	cmd := exec.Command("db_dump", path)
-	out, err := cmd.CombinedOutput()
+	var errOut bytes.Buffer
+	cmd.Stderr = &errOut
+	out, err := cmd.Output()
 	if err != nil {
-		return nil, fmt.Errorf("db_dump: %w: %s", err, strings.TrimSpace(string(out)))
+		return nil, fmt.Errorf("db_dump: %w: %s", err, strings.TrimSpace(errOut.String()))
 	}
 	return out, nil
 }