port 25 ends DATA only at CRLF.CRLF: smtpd_forbid_bare_newline=normalize (port25-bare-newline)

Postfix 3.7.11 leaves its 2023 SMTP-smuggling defence off (default "no"
before 3.9, src/smtpd/smtpd.c:807), and the inbound relay's smtp/inet
listener did not turn it on: a "." line ended by a bare LF ended DATA and
what followed was read as the next transaction. The listener now sets
normalize (bare_lf_mask_table, smtpd.c:1656; the DATA loop drops such a
"." line, 3649-3652), the setting Postfix recommends and 3.9's default.
The submission ports keep the default (own-mta-builds, section 5).

Tests: e2e inbound_bare_newline_is_one_message sends the smuggling
sequence over raw SMTP (net/smtp's DotWriter would rewrite the bare LF)
and finds one message at the upstream with the smuggled part inside;
port25 config check asserts the parameter on smtp/inet. On the server:
make e2e exit 0 (511 s), go vet + go test 27 packages ok.

Docs: CHANGELOG [Unreleased] Security, security.md, architecture.md,
guide.md; roadmap: port25-bare-newline, base-trixie and
panel-dkim-signing agreed by the owner in this order.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -262,7 +262,14 @@ operator can act on it.
   is never accepted with nowhere to send it. Prefer recipient mode `list` to
   refuse unknown addresses at RCPT (no backscatter). OpenDKIM is not attached
   on inbound. An optional antispam milter is inbound-only; default action is
-  fail-open (`accept`).
+  fail-open (`accept`). Since `2.6.1` the listener ends DATA only at the
+  standard `<CR><LF>.<CR><LF>` (`smtpd_forbid_bare_newline=normalize`, the
+  2023 SMTP-smuggling defence, which Postfix 3.7 leaves off by default): a
+  `.` line next to a bare newline is body, and what a smuggler would put
+  behind it is delivered as part of the one message, not read as a second
+  transaction. The submission ports keep the default - there a smuggled
+  transaction is still the authenticated session's, under its sender
+  bindings and milters ([own-mta-builds](own-mta-builds-2026-10-15.md) § 5).
 - **The panel's milters judge every message of a connection.** Postfix
   introduces a client to a milter once per connection, and the milter library
   replaces the milter's session after any reply that is not "continue". Until