audit 2c: the From: parser port checked against OpenDKIM's signing itself

The last check of the port, and the plan's last line of stage 2c. Through
Postfix the sender check refuses most lines before OpenDKIM sees them, so
TestPortAgainstOpenDKIM (internal/milter) talks to OpenDKIM directly:
test/upstream/opendkim-probe.sh starts OpenDKIM from the SelfPost image in
a throwaway container, with keys and a refile SigningTable for three
names, and the test plays it each From: line through go-milter's client,
as a client OpenDKIM trusts (127.0.0.1, InternalHosts' default). For each
line the d= of the signature OpenDKIM adds must be the domain the port
predicts - its address, the domain cut to DKIM_MAXHOSTNAMELEN, the whole
cut to MAXADDRESS, matched against "^.*@<domain>$" case-insensitive as
dkimf_apply_signtable() matches - or neither signs.

Run on the test server, 2026-10-15 (OpenDKIM Filter v2.11.0 from the
image): 385 lines - both shared files and lines composed from display
names plain, quoted, escaped and encoded, comments nested and open,
groups, lists, brackets, source routes, domain literals and quoted local
parts, with the other sender's name and the server's in each place - 385
agree, 287 signed. The two lines padded so that, cut at 256 bytes, they
end in "@other.e2e.test" are signed by OpenDKIM with other.e2e.test's key:
the danger the sender check's 256-byte rule (3584adc) closes is real, and
the test now asserts it.

Measured while writing it: OpenDKIM answers a step it is done with by
accepting the message and then nothing more, and go-milter v0.4.1's client
needs read timeouts set in ClientOptions (the defaults apply only to its
default options) - the probe reads every step's action.

The differential test of the parser and this probe are now scripts in the
repository, test/upstream/mailparse-diff.sh and opendkim-probe.sh, both
run from it on the server: 200 019 lines agree with the C, 385 with the
signing. go vet and go test ./... pass on the server (24 packages). Stage
2c's plan lines are all ticked; roadmap 49/81.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -875,7 +875,7 @@ those after it move up one patch number each.
    longer address is refused - cut there, a quoted local part could end in
    another tenant's domain. The check asks for header values with their
    leading space, as OpenDKIM does; the SigningTable reader goes.
-- [ ] **The port checked against OpenDKIM itself.** On the stand, several
+- [x] **The port checked against OpenDKIM itself.** On the stand, several
    hundred generated `From:` lines - quotes, escapes, comments nested and
    open, groups, brackets, encoded words, a second domain of the server in
    every place - are sent; for each, the domain the port names must be the
@@ -883,6 +883,16 @@ those after it move up one patch number each.
    shared files of lines (`from-lines-passed.txt`, `from-lines-other.txt`)
    are kept: the second one's test becomes "never signed for {other}"
    rather than "refused". - **Opus**
+   *Done 2026-10-15:* not through Postfix, where the check refuses most of
+   the lines first, but straight to OpenDKIM: `TestPortAgainstOpenDKIM`
+   (internal/milter, test/upstream/opendkim-probe.sh)
+   starts OpenDKIM from the image with keys for three names and plays it 385
+   lines - the two shared files and lines composed from display names,
+   comments, groups, routes, literals and quoted local parts - through
+   go-milter's client; for each, the d= OpenDKIM signs with is the domain the
+   port predicts (its address, cut at 256 bytes, against the SigningTable),
+   385 of 385, 287 signed. The two lines padded to be cut at 256 bytes are
+   signed by OpenDKIM with the other domain's key, as read in the source.
 - [x] **The heuristics review: every assumption about another component,
    answered from its source** (owner, 2026-10-14: "нам нужно полное ревью
    кода на предмет всей этой эвристики. Её не должно там, где можно
@@ -1057,9 +1067,10 @@ those after it move up one patch number each.
    PNG (D-B16); a published port nothing listens on is refused over IPv4,
    accepted by the proxy otherwise (D-guide:61); deny beats allow in every
    mix on rspamd 3.11.1-3 (D-arch:121); rspamd runs as uid 11333 (D-sec:424).
-- [ ] Docs and wording: help topic sender-check and guide § Who an
+- [x] Docs and wording: help topic sender-check and guide § Who an
    application may send as (mockup first), security.md § Mail path,
    CHANGELOG. - **Sonnet**
+   *Done 2026-10-15* with the port (`2cf118c` the help mockup, `3584adc`).
 
 ### Stage 3 — persistence and restore (M1–M5, L1–L4, L7) → `2.5.3`