entrypoint: no link followed at the DMARC maps (audit I2)

Security audit 2026-10-17, finding I2 (= M4), stage 0. drop_links listed
the outbound maps, sasldb2, the key tree and mail.log but not the three
DMARC maps that postfix-config.sh creates as root with `[ -e ] || : >`
when DMARC_REPORTS_ENABLE=true; -e is false for a dangling link and the
redirect follows it, and /data/postfix is the panel's. Now the three are in
drop_links, and both map loops refuse to create through a link
(`[ -e ] || [ -L ] || : >`).

e2e: TestStartsOnA28Data plants a dangling /data/postfix/dmarc_transport
with DMARC reports on and expects the "removing the symbolic link" line,
no file at the link's target, and a regular map. To be run on the server
with the stage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -693,9 +693,10 @@ the argument.
   tests pass with the field. — **Opus**, 2 h. *Done 2026-10-17:* also on a
   change of e-mail (where reset links go); a save of the name and the
   reach alone is not asked; TestUserFormAsksForTheAccountPassword.
-- [ ] **I2.** The three DMARC maps in `drop_links`; `[ -L ]` beside `[ -e ]`
+- [x] **I2.** The three DMARC maps in `drop_links`; `[ -L ]` beside `[ -e ]`
   in postfix-config.sh:538,545; an e2e case plants a link and expects the
-  log line. — **Opus**, 0.5 h.
+  log line. — **Opus**, 0.5 h. *Done 2026-10-17:* TestStartsOnA28Data
+  plants a dangling `dmarc_transport` with DMARC reports on.
 - [ ] **M2.** Greedy reply group anchored on Postfix's own tail; the live
   line above as a test; security.md § Mail path reworded ("the last `;
   from=<`, which is Postfix's because a HELO name can hold none of