sasldb2 changed through a copy renamed over it, never in place

Cyrus SASL 2.1.28 opens sasldb2 with no Berkeley DB environment, so with
no locks (sasldb/db_berkeley.c, berkeleydb_open(): db_create(mbdb, NULL,
0)); saslpasswd2 puts and deletes in the file itself (_sasldb_putdata()),
while smtpd opens and closes it at every AUTH (_sasldb_getdata()) and the
backup copies it whenever it runs. Either could read a half-written page:
a spurious 535, or a torn sasldb2 in a backup whose restore breaks every
application's AUTH (assumptions C-S3, C-Q3).

SASLDB.Set and Delete now run saslpasswd2 on sasldb2.new - a byte copy of
the database, or no file when there is none yet (saslpasswd2 creates it,
DB_CREATE) - then chmod 0640, fsync, rename over sasldb2; a failed run
removes the copy and leaves the database; a copy a killed panel left is
removed first. A mutex keeps two changes of the panel from copying the
same old file. The backup needs no lock after all (the plan said one): it
reads each file through one descriptor, and a rename leaves that file
whole; the walk now leaves out a file that vanished between listing and
open (a writer's temporary file), while the SQLite snapshot's absence
stays an error. CHANGELOG also gains the entries of f2ad699 (supervision),
written then without them.

Tests: the copy holds the database's bytes, saslpasswd2 never gets the
live path, a reader of the old file keeps reading it (Linux), mode 0640,
nothing left behind; a failed change leaves the database; the first
account creates it. Stand (2026-10-15, make e2e, exit 0): new
sasldb_changed_by_rename - the inode of sasldb2 changes across one
password change (it cannot be the old one's: both exist at the copy),
then 35 AUTHs of app1 from three clients during 104 password changes of
another application, none refused; afterwards 640 panel selfpost, no copy
left in /data/sasl, the last password authenticates. That cannot prove a
race absent; it guards the mechanism. (A first run compared the inode
after 15 changes and found it equal: Linux reuses a freed inode number.)
go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -91,6 +91,33 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   sender was empty, so a bounce could be refused or allowed by an entry the
   Filter lists page never showed as used. They now look at the envelope
   sender only (assumptions C-R4).
+- **Stopping or restarting the container stops Postfix as Postfix means it
+  to be stopped.** Supervisord's stop signal reached only the shell that
+  started Postfix, never Postfix's master process: a restart of the program
+  found Postfix "already running", and a container stop cut Postfix off at
+  the end. The start wrapper now runs `postfix stop` (assumptions C-P42).
+- **Postfix that cannot start takes the container down instead of waiting
+  for ever.** When the milter sockets never appear, the wrapper gives up
+  after `MILTER_WAIT_TIMEOUT`; that exit was taken for an ordinary one and
+  the wrapper started again, endlessly. It now counts as a failed start,
+  and once supervisord's three retries are spent the container exits for
+  Docker to restart it. For `MILTER_WAIT_TIMEOUT` plus ten seconds after
+  each start, Server > Health shows Postfix as starting (assumptions C-V6).
+- **A logrotate configuration it would ignore ends in a fault shown on
+  Server > Health,** where logrotate was restarted every second for ever;
+  the container stays up, mail is not affected (assumptions C-V5).
+- **A failed Postfix reload is reported.** The panel took a reload as done
+  as soon as it was started, and a reload already running as its own. It now
+  waits for `postfix reload` to finish and shows its failure on the page that
+  saved; a reload while Postfix is still starting is left to the start
+  (assumptions B-U2).
+- **Changing an application's password no longer rewrites the live SASL
+  database.** `saslpasswd2` wrote into the file Postfix reads at every
+  `AUTH` and the backup copies, with no lock between them: an application
+  signing in at that moment could be refused, and a backup taken then could
+  carry a damaged database whose restore would refuse every application.
+  The change is now made to a copy that replaces the file whole (assumptions
+  C-S3, C-Q3).
 
 ### Changed