v2026.09.04.03 — 2026-09-04

• fix(apparmor): watcher's denial filter required a substring that never occurs in real kernel output
• fix(mail): bound doveadm sieve calls with a timeout, no more unbounded agent hang