release: 2.6.1: port 25 ends DATA only at CRLF.CRLF

Cut without asking, as the owner said on 2026-10-15.

The inbound relay's smtp/inet listener sets
smtpd_forbid_bare_newline=normalize, the SMTP-smuggling defence Postfix
3.7.11 leaves off (aaa9412, port25-bare-newline, the first of the three
rows from own-mta-builds).

Rolled out to the test server as 2.6.0-post.aaa9412 (the same code): the
container healthy, every program RUNNING; the server runs the inbound
relay, and postconf -P shows smtp/inet/smtpd_forbid_bare_newline =
normalize next to syslog_name postfix/inbound; no warning or fatal in
docker logs. No migration, schema 11.

CHANGELOG cut; pin 2.6.1 in deploy/docker-compose.yml, README, guide (and
its sample restore message); development.md "from pin" and the row;
roadmap row shipped and the recommended order. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `2.6.0`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.6.1`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -137,6 +137,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 24 | audit-2026-10-12 stage 3: persistence and restore | `2.5.3` |
 | 25 | audit-2026-10-12 stage 4: panel behaviour | `2.5.4` |
 | 26 | audit-2026-10-12 stage 5: image and Postfix hardening | `2.6.0` |
+| 27 | port25-bare-newline | `2.6.1` (PATCH) |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.