panel-dkim-signing stage 2: OpenDKIM removed

The panel's signer is the only one. Gone: the opendkim package and its
configuration, the syslog-relay and opendkim programs, /dev/log and
/run/opendkim, the reload by USR1 through supervisord
(internal/supervisor/supervisor.go), internal/syslogrelay, the port of
OpenDKIM's From: parser (internal/milter/mailparse.go and its probe,
harness and test/upstream scripts), OPENDKIM_SOCKET and OPENDKIM_DIR.

Keys: internal/domain/keys.go (Keys, NewKeys, DKIM_DIR=/data/dkim) keeps
the keys and writes a selector table, /data/dkim/selectors ("<name>
<selector>"), which the signer reads in place of the KeyTable - it reads
no database, as the sender check reads none. The table is written before
the signer serves (EnsureServerSigned moved there from the notifier).
Keys and table 0600, directories 0700, the panel's. The entrypoint copies
/data/opendkim/keys once, as the panel user, into /data/dkim.new renamed
when whole, and stops the start if the copy fails; /data/opendkim is left
for a rollback to 2.7.x.

Sender check: one RFC 5322 address as a mail program reads it, held
against the bindings; the 256-byte refusal and the texts naming OpenDKIM
go. Allowed() folded the domain through strings.ToLower, which makes the
Kelvin sign a "k" - the comparison with OpenDKIM's reading had hidden it;
it folds ASCII only now.

Health: two dkim-signer rows (applications, notifications) in Milter
sockets, opendkim out of the liveness set; the card no longer takes any
row with a note for the spam filter. Texts as in the design commit.

KILL stays in deploy/docker-compose.yml: measured on the test server,
root without it cannot signal a process of another uid - supervisord
stopping the panel, Postfix's master its children. The plan's "only use
was the reload" was wrong; the comment now gives the real uses.

e2e: one signature, the panel's, verified by dkimpy; the /data/dkim modes;
the OpenDKIM log and process checks, testNeverSignedForAnother and the
cited opendkim, libopendkim11 and libmilter1.0.1 go.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/testdata/from-lines-other.txt

@@ -1,15 +1,11 @@
 # From: lines that name another sender of this server, {other}, beside or in
 # place of the application's own address at {domain} (review of audit stage
-# 2). None may be signed with {other}'s key. Since stage 2c the check reads a
-# line with OpenDKIM's own parser, so it passes those whose address OpenDKIM
-# reads at {domain} - {other} in a display name, a comment or a quoted local
-# part - and refuses the rest. The unit test
-# (internal/milter/sender_test.go) wants every line it passes read at
-# {domain}; the e2e (test/e2e/dkim_from_test.go) sends each and wants
-# nothing signed for {other}. {OTHER} is {other} in capitals; {other_qp} is {other} with each
-# dot escaped as a quoted pair. One Go-quoted string per line. The lines are
-# composed by hand; that OpenDKIM signs none for {other} is measured, by the
-# e2e on every run.
+# 2). None may pass as {other}: the check passes a line only when a mail
+# program reads it as one address at {domain} - {other} in a quoted display
+# name or a comment, or inside a quoted local part - and refuses the rest.
+# The unit test (internal/milter/sender_test.go) wants every line it passes
+# read so. {OTHER} is {other} in capitals; {other_qp} is {other} with each dot
+# escaped as a quoted pair. One Go-quoted string per line.
 "b@{other}"
 "<b@{other}>"
 "\"a@{domain}\"@{other}"

internal/milter/testdata/from-lines-passed.txt

@@ -1,15 +1,12 @@
 # From: lines the sender check lets through for an application of {domain}
-# (audit 2026-10-12, stage 2: which key OpenDKIM signs with, seen and not
-# reasoned). One Go-quoted string per line; {domain} is the application's
-# domain. Two tests read this file: the check's unit test
+# (audit 2026-10-12, stage 2). One Go-quoted string per line; {domain} is the
+# application's domain. Two tests read this file: the check's unit test
 # (internal/milter/sender_test.go) wants each line passed, and the e2e
 # (test/e2e/dkim_from_test.go) sends each one and wants the message signed
-# for {domain} and nothing else. A line added here is run by both. {DOMAIN}
+# for {domain} - the signer's key is the login's - with a signature that
+# validates over these headers. A line added here is run by both. {DOMAIN}
 # is {domain} in capitals; {other} is another sender of the server, which a
-# line here names in a way the check's scan does not see (a space after the
-# @) - passed by design, and so signed for {domain} alone.
-# The lines are composed by hand; what OpenDKIM signs each with is measured,
-# by the e2e on every run.
+# line here names inside a quoted display name - passed by design.
 "a@{domain}"
 "<a@{domain}>"
 "\"The Shop\" <Orders@{domain}>"

internal/milter/testdata/mailparse_harness.c

@@ -1,56 +0,0 @@
-/*
- * Differential harness for internal/milter/mailparse.go: OpenDKIM's own
- * dkim_mail_parse() (libopendkim/dkim-mailparse.c of the opendkim source the
- * image runs, compiled in by #include), fed one hex-encoded line per input
- * line. Output per line: the error, then the local part and the domain, each
- * "-" when NULL and "=" followed by its bytes in hex otherwise.
- *
- *   test/upstream/mailparse-diff.sh <opendkim source dir>
- *
- * builds it in debian:trixie and runs TestMailParseMatchesOpenDKIM with it.
- */
-#include <sys/types.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include "dkim-mailparse.c"
-
-static int hexval(int c)
-{
-	if (c >= '0' && c <= '9') return c - '0';
-	if (c >= 'a' && c <= 'f') return c - 'a' + 10;
-	return -1;
-}
-
-static void put(const unsigned char *s)
-{
-	if (s == NULL) {
-		fputs(" -", stdout);
-		return;
-	}
-	fputs(" =", stdout);
-	for (; *s != '\0'; s++)
-		printf("%02x", *s);
-}
-
-int main(void)
-{
-	static char hex[1 << 20];
-	static unsigned char buf[1 << 19];
-
-	while (fgets(hex, sizeof hex, stdin) != NULL) {
-		size_t n = strcspn(hex, "\r\n"), i;
-		unsigned char *user, *domain;
-		int err;
-
-		for (i = 0; i + 1 < n; i += 2)
-			buf[i / 2] = (unsigned char) (hexval(hex[i]) << 4 | hexval(hex[i + 1]));
-		buf[n / 2] = '\0';
-		err = dkim_mail_parse(buf, &user, &domain);
-		printf("%d", err);
-		put(user);
-		put(domain);
-		putchar('\n');
-	}
-	return 0;
-}