audit: stage 2c - the inventory of what SelfPost assumes of other programs

docs/assumptions-2026-10-14.md: four read-only readings of the tree at
0f984ff (log tailer/Health/cmd/panel; milters/postfix/app/domain;
build/deploy/inbound/DMARC/backup/e2e; store/web and the claims of
architecture, security and guide), each place rated by what justifies it
today. 621 entries: 3 cited, 25 measured, 535 guessed, 58 with a reason to
think them false - among them expiry (Postfix logs status=expired once per
message, without to=, so expired rows stay deferred), the sender check
accepting a From: any key lists while Postfix takes the first key found,
cleanup capping inbound mail at main.cf's 10240000 bytes, and the
milter-reject line carrying sasl_username after all.

Sources read: the Debian bookworm packages the image installs (apt-get
source), go-milter v0.4.1 and modernc v1.60.1 from the module cache.
Next: the answers, entry by entry.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -227,10 +227,17 @@ what it relies on and where that is written, for the version the image runs
 (the Debian bookworm package, not upstream's head):
 
 ```go
-// Postfix 3.7.11, src/smtpd/smtpd_check.c, check_sender_login():
-// the SASL login is compared with the sender map's owners by strcasecmp.
+// Postfix 3.7.11, src/smtpd/smtpd_check.c,
+// reject_auth_sender_login_mismatch(): the SASL login is compared with
+// each owner in sender_login_maps by strcasecmp_utf8.
 ```
 
+The Debian sources of the image's versions are fetched with `apt-get source`
+inside a `debian:bookworm` container (`postfix`, `opendkim`, `cyrus-sasl2`,
+`supervisor`, `logrotate`); `dev/upstream/` (not in git) is where they are
+kept for reading. Go modules are read in the module cache at the version
+`go.mod` pins.
+
 A document instead of source: its URL and section. Where neither answers the
 question, the comment says so and what was measured instead - "measured on
 the e2e stand, 2026-10-14: ..." - and a measurement is never written as if