feat: implement C.4 — hermetic container e2e gate + native release build

Separate test/e2e Go module drives the shipped deploy/docker-compose.yml
(plus a test-only override: self-signed cert, low ports, isolated compose
project) against a fake DNS zone (CoreDNS) and an smtp-sink MX, exactly as
an administrator and their applications would over HTTP/SMTP — covering the
class of failure unit tests can't see (container wiring). Positive path:
setup -> login -> domain -> DKIM record published into the fake zone ->
application -> SMTP AUTH send -> DKIM verified against the DNS-published
key -> send-log queued->sent. Negative: no-AUTH/unauthenticated relay,
sender/login mismatch, L1 (anvil) and L2 (panel) rate limits, journal-milter
fail-open, SELFPOST_HOSTNAME gate, session survives docker restart.

release.yml moves off qemu to a native per-arch build (amd64/arm64), each
gated by this suite before its tag is pushed and merged into the version
manifest.

Verified green on selfpost.example.com via `make e2e`; go vet/gofmt clean in
both modules.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,25 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+- ci: hermetic container e2e suite (`test/e2e`, a separate Go module) gates
+  image publishing — `make e2e` locally, and `go test ./...` in `test/e2e` as
+  a required step in `release.yml` before a version tag's image is pushed.
+  It builds the real image, brings up the shipped `deploy/docker-compose.yml`
+  plus a test-only override (self-signed cert, low ports, a fake DNS zone
+  served by CoreDNS, a `smtp-sink` sink-MX) on an isolated compose project,
+  then drives the panel over HTTP exactly like an administrator: setup →
+  login → add a domain → publish the DKIM record it prints into the fake zone
+  → add an application → send over SMTP AUTH → verify the delivered message's
+  DKIM signature against the record the panel published → poll the send log
+  to `sent`. Negative coverage: no-AUTH and unauthenticated-relay rejection,
+  sender/login mismatch, the level-1 (anvil) and level-2 (panel-configured)
+  rate limits, the journal-milter's fail-open behaviour when the panel process
+  is stopped, a missing/malformed `SELFPOST_HOSTNAME` failing the container
+  fast, and a login session surviving `docker restart`. `release.yml` moved
+  off qemu to a native per-architecture build (`ubuntu-latest` /
+  `ubuntu-24.04-arm`), each gated by this suite before its tag is pushed and
+  merged into the version manifest — running the full Postfix/OpenDKIM stack
+  under emulation for the gate was impractically slow.
 - ops: `mail.log` rotation switched from `copytruncate` to rename +
   `postfix reload` (the same mechanism `postfix logrotate` itself uses),
   eliminating the up-to-one-second window in which `copytruncate` could drop