release: 2.6.0: audit stage 5 - image and Postfix hardening

Cut without asking, as the owner said on 2026-10-15.

The supervisord socket is root:supervisor, the panel the group's one member
(M17). Postfix takes TLS 1.2 at least, the client too where TLS is
required; VRFY off; the banner without the distribution; the start refuses
a rate, size or milter timeout that is not a number, under its minimum or
past an int (L31). OpenDKIM logs through the syslog relay to the container
log and oversigns From: (L30). crashexit takes the container down after
five unexpected exits of a mail-path program in ten minutes (L32).
logrotate keeps its state under /data/log. extract-cert.sh refuses what is
not PEM and renames whole files (M21). Plus the findings of both reviews
(a39eda5). Commits dab7715, a39eda5, b09e525.

Rolled out to the test server as 2.5.4-post.95af363 (the same code): the
container healthy, every program RUNNING, syslog-relay among them;
OpenDKIM's start line in docker logs under "syslog: "; the postconf values
as set; /run/supervisor.sock root:supervisor 0770 and the panel reaches it;
/data/log/.logrotate.status written. No migration, schema 11.

CHANGELOG cut; pin 2.6.0 in deploy/docker-compose.yml, README, guide (and
its sample restore message); development.md "from pin" and the stage's row;
roadmap row and recommended order; stage 5 marked shipped in the plan. No
tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -1416,7 +1416,7 @@ failed `SetNotifyAddressees` is logged and the subject stays said, the next
 follow-up finds nobody owed; the profile form's "username taken" is
 documented in security.md.
 
-### Stage 5 — image and Postfix hardening (M17–M19, M21, L30–L32) → `2.6.0`
+### Stage 5 — image and Postfix hardening (M17–M19, M21, L30–L32) → `2.6.0` (shipped 2026-10-15)
 
 - [x] **Supervisor socket**: a group of its own (`supervisor`), panel only;
    `postfix`/`opendkim` keep `selfpost` for the file paths. — **Opus**