Phase 1: Docker image, supervisord, three-process cold start

Single bookworm-slim image running opendkim + panel + postfix under
supervisord with enforced start ordering (spec 4):

- build/Dockerfile: multi-stage static Go build; runtime installs postfix,
  opendkim, cyrus-sasl, supervisor, logrotate; unprivileged panel user (7.6.8).
- build/supervisord.conf: priority ordering opendkim -> panel -> postfix;
  crashexit event listener terminates the container on any FATAL process.
- build/postfix-wrapper.sh: waits for both milter sockets (test -S, 30s
  timeout) before `postfix start-fg`, exits non-zero on timeout.
- panel: HTTP :8080 stub + /healthz, journal-milter socket stub (so the
  wrapper's readiness probe passes), log-tailer stub; SIGTERM graceful stop.

Verified on the dev server: image builds, three processes live, panel serves
the stub, wrapper waits for sockets, and an unrecoverable panel failure brings
the container down cleanly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build/crashexit.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""Supervisor event listener: bring the container down on unrecoverable failure.
+
+If any managed program exhausts its restart retries and enters FATAL, this
+listener signals supervisord (its parent) to terminate, so the whole container
+exits and Docker's `restart` policy can recreate it cleanly — rather than
+lingering "alive" with a dead Postfix/OpenDKIM/panel (spec 4).
+
+Communication with supervisord uses the event listener protocol over stdin and
+stdout, so stdout must carry only protocol tokens.
+"""
+import os
+import signal
+import sys
+
+
+def write_stdout(s):
+    sys.stdout.write(s)
+    sys.stdout.flush()
+
+
+def main():
+    while True:
+        # Tell supervisord we are ready for the next event.
+        write_stdout("READY\n")
+
+        line = sys.stdin.readline()
+        if not line:
+            return
+        headers = dict(pair.split(":", 1) for pair in line.split())
+        payload_len = int(headers.get("len", 0))
+        if payload_len:
+            sys.stdin.read(payload_len)
+
+        # We only subscribe to PROCESS_STATE_FATAL, so any event means a managed
+        # program can no longer be restarted. Take the container down.
+        sys.stderr.write(
+            "crashexit: a managed process entered FATAL; shutting down container\n"
+        )
+        sys.stderr.flush()
+        os.kill(os.getppid(), signal.SIGTERM)
+
+        write_stdout("RESULT 2\nOK")
+
+
+if __name__ == "__main__":
+    main()