release: 2.8.0: panel-dkim-signing - the panel signs, OpenDKIM gone

Cut at the owner's word (2026-10-16, "Выпускай").

The panel signs outgoing mail in a milter of its own (go-msgauth,
relaxed/simple, the login's key on 465/587 and the server's name's on
local mail); OpenDKIM, the syslog relay, the USR1 reload and the From:
parser port are gone. Keys move to /data/dkim (copied once; /data/opendkim
kept for a rollback, left out of backups). The sender check holds Sender:
like From:. go-milter is built patched not to keep every header. The queue
is handed to Postfix's users by name before "postfix check". Commits
005922b..ca3a183 (005922b, faa3c11, c2f63d2, f0dd9f9, 2cfd239, d9d9af3,
0cceb54, 80faf1a, f1d90a2, ca3a183).

On the test server since 2026-10-15 22:48 UTC (2.7.0-post.c2f63d2, now
2.7.0-post.f1d90a2, the same code as this cut): healthy, keys unchanged.
The first rollout (faa3c11) crash-looped five minutes on the queue's owner
numbers and was rolled back; fixed in c2f63d2. The owner's canary: Gmail
dkim/spf/dmarc pass with d=carrel.mixfed.ru, Yandex dkim/spf pass, not
spam; his From:/Sender: check, thirteen cases, all as expected.

CHANGELOG [2.8.0]; pins in deploy/docker-compose.yml, README and the guide
(the guide's rollback command keeps naming 2.7.0 on purpose); development's
"from pin"; roadmap row and recommended order; plan stage 3 closed. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/panel-dkim-signing.md

@@ -1,6 +1,6 @@
 # Plan: panel-dkim-signing
 
-**Status:** agreed, 2026-10-15 - the row is agreed (owner, 2026-10-15, the
+**Status:** shipped `2.8.0` (2026-10-16); agreed 2026-10-15 - the row is agreed (owner, 2026-10-15, the
 order port25-bare-newline -> base-trixie -> panel-dkim-signing); three
 questions below were settled one at a time the same day.  
 **Date:** 2026-10-15  
@@ -214,10 +214,23 @@ documents in the commit after it. `Sender:` is held to the login like
 v0.4.1 kept every header in a map of its own per session, on 465/587 and on
 port 25 alike: the panel builds it patched not to
 (`third_party/go-milter/PATCHES.md`; the owner's decision, 2026-10-16).
-- [ ] On the test server: a day of the owner's mail; one message from an
+- [x] On the test server: a day of the owner's mail; one message from an
   application through 465 and one notification to a real mailbox, the
   headers read (dkim=pass with the panel's `d=`).
-- [ ] Cut `2.8.0`.
+- [x] Cut `2.8.0`.
+
+*Done (2026-10-16):* the owner's message through 465 (`dev/send-check.ps1`)
+arrived at Gmail with `dkim=pass header.i=@carrel.mixfed.ru
+header.s=selfpost`, `spf=pass`, `dmarc=pass`, and at Yandex with
+`dkim=pass` and `X-Yandex-Spam: 1`; its `h=` over-signs the shown headers.
+His `dev/from-check.ps1` sent thirteen `From:`/`Sender:` cases: four
+accepted and delivered, nine refused as expected, each a send-log row of
+reason `from` or `sender`. The notification to a real mailbox was not
+sent - nothing raised one; its signature is verified by dkimpy on every e2e
+run, and the server name's key, unchanged by the move (digests compared),
+matched its published record on 2026-10-15. The day of mail was cut short
+at the owner's word ("Выпускай", 2026-10-16), the test server having run
+the stage's code since 2026-10-15 22:48 UTC. Cut as `2.8.0`, no tag.
 
 ## Risks