Manual chmod 1730 on maildrop caused postsuper scan_dir_push failures
because the group (postdrop) lacked read permission. Let Postfix set
the exact permissions it expects via set-permissions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Postfix relay image with Cyrus SASL (sasldb2) authentication.
Replaces mwader/postfix-relay with a controlled image built via Kaniko and
stored in Harbor. Credentials injected from Vault ExternalSecret at startup.