logtail, health, panel: cite the source of what they rely on (assumptions part A)

Comments only, no behaviour changed. Each place the log tailer, Health and
cmd/panel rely on another program now says where that is written, for the
version the image runs: Postfix 3.7.11 (log_adhoc(), msg_logger_print(),
smtpd_whatsup(), cleanup_milter.c, qmgr_active.c, postlogd.c, showq.c,
pipe.c), logrotate 3.21.0, supervisor 4.2.5, proc(5). Measurements stay
measurements and say where and when; test fixtures say whether they were
seen or composed.

Where the source contradicts the code the comment does not bless it but
names the register entry (A-8 expiry, A-12 the ISO stamp no Postfix writes,
A-15 the last recipient, A-21/A-23 sasl_username, A-33 postlogd's old
inode, A-38 a socket file is not a listener, A-65 the certificate served);
those are fixed in their own commits.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/health/socket.go

@@ -18,9 +18,17 @@ type Socket struct {
 }
 
 // CheckSocket stats a milter socket. required distinguishes the two milters:
-// OpenDKIM runs with default_action=tempfail, so a missing socket stops mail
-// leaving the server, while the journal-milter fails open — mail still goes out,
-// only the send log stops being written.
+// Postfix attaches OpenDKIM with default_action=tempfail, so a missing socket
+// stops mail leaving the server, while the journal-milter is attached with
+// default_action=accept and fails open — mail still goes out, only the send
+// log stops being written (build/postfix-config.sh smtpd_milters; Postfix
+// 3.7.11, src/milter/milter8.c, milter8_comm_error(): tempfail answers "451
+// 4.7.1 Service unavailable - try again later", accept answers nothing).
+//
+// A socket file that is there is reported as listening. It is not proof of
+// it: a unix socket's file outlives the process that bound it unless that
+// process unlinks it (unix(7)), so a killed OpenDKIM or panel leaves one that
+// refuses every connection - assumptions A-38.
 func CheckSocket(name, path string, required bool) Socket {
 	s := Socket{Name: name, Path: path}
 	if path == "" {