postfix config: port 25's size limit for cleanup too, no local delivery

Port 25 says it takes INBOUND_MESSAGE_SIZE_LIMIT (25 MiB by default) with
smtpd -o message_size_limit, but cleanup writes the queue file under its
own limit, main.cf's - never set, so DEF_MESSAGE_LIMIT, 10240000 (Postfix
3.7.11, src/cleanup/cleanup_init.c, cleanup_post_jail(), set_file_limit();
src/global/mail_params.h). A larger message went through DATA and was
refused 552 (assumptions C-P31). cleanup now gets port 25's limit as a
master.cf -o when it is larger than main.cf's; 465 and 587 keep main.cf's
in smtpd's own DATA/BDAT checks. /etc/postfix outlives a restart, so the
override is removed with postconf -PX first on every start.

An empty mydestination left one local destination: an address literal of
an interface the container listens on (src/global/resolve_local.c,
resolve_local(), own_inet_addr()). local_transport is now
"error:local mail delivery is disabled", as STANDARD_CONFIGURATION_README's
null client has it (assumptions C-P8).

Stand (2026-10-14, make e2e, exit 0): inbound_relay_delivers_and_refuses
sends a 12 MB message through port 25 and finds it at the upstream, and
counts it among the Inbound log's rows; new address_literal_is_not_local -
probe@[127.0.0.1] from an application is refused at RCPT "550 5.1.1 ...
local mail delivery is disabled" (smtpd's check_rcpt_maps() rejects what
resolves to the error transport; before, local(8) took it). go vet and go
test ./... pass on the server (23 packages). Tested together with the next
commit (the log tailer); the two touch no common file.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/delivery_log_test.go

@@ -181,3 +181,23 @@ print("; ".join(r[0]+" "+r[1] for r in rows))`, token)
 		t.Fatal(err)
 	}
 }
+
+// testAddressLiteralIsNotLocal: an address literal of an interface the
+// container listens on is a local destination to Postfix even with an empty
+// mydestination (Postfix 3.7.11, src/global/resolve_local.c,
+// resolve_local()). Local delivery is Postfix's refusal now
+// (local_transport=error:..., assumptions C-P8), and smtpd refuses such a
+// recipient at RCPT with its text: smtpd_reject_unlisted_recipient (on by
+// default) runs check_rcpt_maps(), which rejects whatever resolves to the
+// error transport (src/smtpd/smtpd_check.c). Before, the message was
+// accepted and handed to local(8).
+func testAddressLiteralIsNotLocal(t *testing.T, sc *scenario) {
+	res := attemptSend(sendAttempt{
+		authLogin: sc.appLogin, authPassword: sc.appPassword,
+		from: "alerts@" + senderDomain, headerFrom: "alerts@" + senderDomain,
+		to: "probe@[127.0.0.1]", subject: "e2e " + uniqueToken("literal"), body: "to an address literal of the container",
+	})
+	if err := res.refusedAt("RCPT", 550, "local mail delivery is disabled"); err != nil {
+		t.Fatalf("to probe@[127.0.0.1]: %v", err)
+	}
+}