port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)

Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no"
before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet
listener did not turn it on: a "." line ended by a bare LF ended DATA and
what followed was read as the next transaction. The listener now sets
normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a
"." line, 3649-3652), the setting Postfix recommends and 3.9's default.
The submission ports keep the default (own-mta-builds, section 5).

Tests: e2e inbound_bare_newline_is_one_message sends the smuggling
sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF)
and finds one message at the upstream with the smuggled part inside;
port25 config check asserts the parameter on smtp/inet. On the server:
make e2e exit 0 (511 s), go vet + go test 27 packages ok.

Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md,
guide.md; roadmap: port25-bare-newline, base-trixie and
panel-dkim-signing agreed by the owner in this order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,21 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Security
+
+- **Port 25 could be made to read a second transaction out of a message's
+  body.** Postfix 3.7 leaves its 2023 SMTP-smuggling defence off
+  (`smtpd_forbid_bare_newline`, default `no` before 3.9), and the inbound
+  relay's listener did not turn it on: a `.` line ended by a bare newline
+  ended DATA, and what followed was read as the next transaction's commands.
+  The listener now sets `normalize` - the setting Postfix recommends and 3.9
+  made the default: DATA ends only at the standard `<CR><LF>.<CR><LF>`, a
+  bare newline elsewhere is read as a line end. Found while reading for
+  [own-mta-builds](docs/own-mta-builds-2026-10-15.md) (§ 5); `test/e2e`
+  sends the sequence and finds one message at the upstream with all of it
+  inside. Only installations with `INBOUND_RELAY_ENABLE=true` or
+  `DMARC_REPORTS_ENABLE=true` have the listener.
+
 ## [2.6.0] - 2026-10-15
 
 Stage 5 of the 2026-10-12 audit: the image and Postfix. The supervisor