ci: compile the e2e on every push; test/ out of the build context (audit M20, L33)

- test.yml: after go test, `go vet ./...` and `go test -c -o /dev/null .`
  in test/e2e - compiled and linked, not run. Not `go test -run xxx` as
  the plan said: TestMain would still run and bring up the stand. The Go
  cache now keys on test/e2e/go.sum too.
- .dockerignore: test (e2e leftovers in test/e2e/.stage - DKIM keys,
  sasldb2 - no longer reach the builder; the sink image is built from
  test/e2e/sink as its own context, so it is unaffected).
- development.md (test.yml line), CHANGELOG [Unreleased], audit plan
  lines ticked, roadmap 3/61.

Evidence on the test server for this tree: make e2e (no
SELFPOST_E2E_VERSION, so the "e2e" default path) exit 0, including
image_stamped_with_version and the logrotate-mode build; in test/e2e
go vet ./... and go test -c -o /dev/null . clean; docker build of
build/Dockerfile with a file under test/e2e/.stage succeeds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -551,9 +551,10 @@ has already run is never edited — the next file is added; the published
    image already built instead of rebuilding. Done when the e2e asserts
    `panel -version` equals what it was told, and `release.yml` runs that
    assertion before the push. — **Opus**
-- [ ] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
-   test -run xxx ./...`. — **Haiku**
-- [ ] **`.dockerignore` + `test/`** (L33). — **Haiku**
+- [x] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
+   test -c -o /dev/null .` (not `go test -run xxx`: `TestMain` would still
+   run and bring up the stand). — **Haiku**
+- [x] **`.dockerignore` + `test/`** (L33). — **Haiku**
 - [ ] **The pin** (M6): old tags and images are not touched (owner,
    2026-10-12). The next publication through the fixed `release.yml` is the
    one the pin names; until then README/guide say that the current line is