feat: implement C.4 — hermetic container e2e gate + native release build

Separate test/e2e Go module drives the shipped deploy/docker-compose.yml
(plus a test-only override: self-signed cert, low ports, isolated compose
project) against a fake DNS zone (CoreDNS) and an smtp-sink MX, exactly as
an administrator and their applications would over HTTP/SMTP — covering the
class of failure unit tests can't see (container wiring). Positive path:
setup -> login -> domain -> DKIM record published into the fake zone ->
application -> SMTP AUTH send -> DKIM verified against the DNS-published
key -> send-log queued->sent. Negative: no-AUTH/unauthenticated relay,
sender/login mismatch, L1 (anvil) and L2 (panel) rate limits, journal-milter
fail-open, SELFPOST_HOSTNAME gate, session survives docker restart.

release.yml moves off qemu to a native per-arch build (amd64/arm64), each
gated by this suite before its tag is pushed and merged into the version
manifest.

Verified green on selfpost.example.com via `make e2e`; go vet/gofmt clean in
both modules.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -13,7 +13,7 @@ MODULE  := codeberg.org/mix/selfpost
 LDFLAGS := -X $(MODULE)/internal/buildinfo.Version=$(VERSION)
 GOFLAGS := -trimpath
 
-.PHONY: all build vet test clean
+.PHONY: all build vet test clean e2e
 
 all: vet build
 
@@ -29,3 +29,13 @@ test:
 
 clean:
 	rm -rf bin
+
+# Hermetic container e2e (plan implementation-plan.md C.4): separate Go module
+# under test/e2e so its test-only dependencies (DKIM verification) never enter
+# this module's build graph. Builds the image fresh from this checkout, brings
+# up deploy/docker-compose.yml plus a test-only override on high ports and an
+# isolated compose project (-p selfpost-e2e) so it never collides with a real
+# deployment on the same host, then tears the stand down whether the suite
+# passed or not.
+e2e:
+	cd test/e2e && go test -v -timeout 20m ./...