ci: compile the e2e on every push; test/ out of the build context (audit M20, L33)

- test.yml: after go test, `go vet ./...` and `go test -c -o /dev/null .`
  in test/e2e - compiled and linked, not run. Not `go test -run xxx` as
  the plan said: TestMain would still run and bring up the stand. The Go
  cache now keys on test/e2e/go.sum too.
- .dockerignore: test (e2e leftovers in test/e2e/.stage - DKIM keys,
  sasldb2 - no longer reach the builder; the sink image is built from
  test/e2e/sink as its own context, so it is unaffected).
- development.md (test.yml line), CHANGELOG [Unreleased], audit plan
  lines ticked, roadmap 3/61.

Evidence on the test server for this tree: make e2e (no
SELFPOST_E2E_VERSION, so the "e2e" default path) exit 0, including
image_stamped_with_version and the logrotate-mode build; in test/e2e
go vet ./... and go test -c -o /dev/null . clean; docker build of
build/Dockerfile with a file under test/e2e/.stage succeeds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.dockerignore

@@ -4,6 +4,9 @@
 .gitattributes
 dev
 docs
+# test/e2e/.stage holds what an e2e run leaves behind (DKIM keys, sasldb2);
+# the e2e's own sink image is built from test/e2e/sink as its own context.
+test
 bin
 *.exe
 README.md

.github/workflows/test.yml

@@ -24,6 +24,9 @@ jobs:
         with:
           go-version: "1.26"
           cache: true
+          cache-dependency-path: |
+            go.sum
+            test/e2e/go.sum
 
       - name: Format
         run: |
@@ -39,3 +42,13 @@ jobs:
 
       - name: Test
         run: go test ./...
+
+      # The e2e module runs only in release.yml, after a release is published;
+      # a type error there would first show up then. Compile it here without
+      # running it: `go test -run` would still run TestMain, which brings up
+      # the whole stand.
+      - name: Compile the e2e
+        working-directory: test/e2e
+        run: |
+          go vet ./...
+          go test -c -o /dev/null .

CHANGELOG.md

@@ -17,6 +17,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `selfpost-backup -version` against it, and `release.yml` checks the stamp
   again on the image right before pushing it. Images already published are
   left as they are.
+- **The e2e module is compiled on every push** (`test.yml`: `go vet` and
+  `go test -c` in `test/e2e`), so a type error there no longer first shows
+  up in `release.yml` after a release is published (audit 2026-10-12, M20).
+- **`test/` is out of the image's build context** (`.dockerignore`): a
+  developer build after an e2e run sent the stand's leftovers - DKIM keys,
+  `sasldb2` - to the builder (audit 2026-10-12, L33).
 
 ## [2.4.1] - 2026-10-12
 

docs/audit-2026-10-12.md

@@ -551,9 +551,10 @@ has already run is never edited — the next file is added; the published
    image already built instead of rebuilding. Done when the e2e asserts
    `panel -version` equals what it was told, and `release.yml` runs that
    assertion before the push. — **Opus**
-- [ ] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
+- [x] **Compile the e2e in `test.yml`** (M20): `cd test/e2e && go vet ./... && go
-   test -run xxx ./...`. — **Haiku**
+   test -c -o /dev/null .` (not `go test -run xxx`: `TestMain` would still
-- [ ] **`.dockerignore` + `test/`** (L33). — **Haiku**
+   run and bring up the stand). — **Haiku**
+- [x] **`.dockerignore` + `test/`** (L33). — **Haiku**
 - [ ] **The pin** (M6): old tags and images are not touched (owner,
    2026-10-12). The next publication through the fixed `release.yml` is the
    one the pin names; until then README/guide say that the current line is

docs/development.md

@@ -428,7 +428,9 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 
 `design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
 `go test ./...` (main module, no e2e; includes the panel guard tests, see
-[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)).
+[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)) → the e2e
+module compiled, not run (`go vet ./...` and `go test -c -o /dev/null .` in
+`test/e2e`).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer
 

docs/roadmap.md

@@ -42,7 +42,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | from-header-binding | Hold a message's `From:` header against the application that sends it | shipped `2.4.0` | 9/9 | [plans/from-header-binding.md](plans/from-header-binding.md) |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | shipped `2.0.0` | 27/27 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | built in panel-redesign (stage 1) | — | [plans/panel-redesign.md](plans/panel-redesign.md) |
-| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | agreed (2026-10-12: stage 0 first, then 1+2; the rest after) | 1/61 | [audit-2026-10-12.md](audit-2026-10-12.md) |
+| audit-2026-10-12 | Follow-ups of the 2026-10-12 full-tree code audit, seven stages | agreed (2026-10-12: stage 0 first, then 1+2; the rest after) | 3/61 | [audit-2026-10-12.md](audit-2026-10-12.md) |
 
 **Recommended order** (not binding; owner, 2026-10-09: feature order follows
 development convenience): **panel-redesign** shipped as `2.0.0` (2026-10-11) and