postfix: a truncated postqueue -p listing is no listing for the sweep (audit H3)

QueueIDs parsed Queue()'s text, which caps postqueue -p at 4 MiB and
appends a note, and returned the ids before the cut with no error: the
reconcile sweep then closed every queued row past the cut as bounced while
Postfix still held the mail. listQueue() now returns the text and whether
it was cut; QueueIDs refuses a cut listing with an error (reconcile already
treats an error as no information), the way postqueueJSON does for the
notifier. Queue() keeps showing the cut listing with its note.

postqueueP is a var so tests run a fake postqueue (the test binary as a
helper process): 5 MiB -> QueueIDs errors, Queue ends with the note; 1000
bytes -> ids read.

CHANGELOG [Unreleased], audit plan line ticked, roadmap 8/61.
Evidence: go test ./internal/postfix ok (Windows); the server run of the
stage follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,17 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Fixed
+
+- **A queue too large to list no longer closes its own messages.** The
+  reconcile sweep asks `postqueue -p` which messages Postfix still holds and
+  closes every `queued` row that is not among them. The listing is capped at
+  4 MiB, and the ids past the cap were read as gone: during a large deferred
+  backlog - the outage the sweep exists for - mail Postfix still held was
+  marked `bounced`. A listing over the cap now tells the sweep nothing, as it
+  already did for the notification about mail waiting too long; the Mail
+  queue page still shows the cut listing with its note (audit 2026-10-12, H3).
+
 ## [2.4.2] - 2026-10-14
 
 Release hygiene: stage 0 of the 2026-10-12 audit. Nothing the panel or the