feat: turnkey Postfix relay setup script for Debian/Ubuntu

[msgwing]

Why

docs/SYSTEM-MTA.md already documents Postfix satellite mode plus the
separate sender-rewrite section it needs to avoid 553 5.7.1 ... not owned by user - correct, but a dozen manual commands across two sections for
someone who just wants their server relaying through ZeroSMTP with a
username and password.

Change

• setup-postfix-relay.sh (new, repo root, alongside check-connection.sh
  and the other root scripts): installs Postfix on Debian/Ubuntu, configures
  satellite/smarthost mode, and applies the sender/From rewrite from the
  existing docs - all three in one idempotent run. Only asks for a ZeroSMTP
  username and password (or the ZEROSMTP_USERNAME/ZEROSMTP_PASSWORD
  env vars for unattended use); the password is never a CLI argument, so it
  never lands in shell history or ps. Refuses to run on anything that
  isn't Debian/Ubuntu (checks /etc/os-release), and on 465 vs 587 sets
  smtp_tls_wrappermode correctly for each.
• docs/SYSTEM-MTA.md: the script is now the first thing under "Top pick:
  Postfix", with the existing manual steps kept below unchanged for anyone
  who wants to see or customize what it's doing.
• .github/workflows/lint.yml: added the new script to the bash job's
  syntax-check list, the same way the three existing root scripts are
  checked.

Test plan

• bash -n setup-postfix-relay.sh - clean (same check CI runs).
• python tools/check-control-chars.py - clean, 257 files.
• python .github/check-workflows.py - clean.
• python tools/build-llms-full.py --check, build-llms-txt.py --check,
  build-readme-toc.py --check - all clean, no page regeneration needed.
• Not run against a live server in this change (no sudo/root available
  here) - the commands are exactly the ones already documented and manually
  verified in docs/SYSTEM-MTA.md, now composed into one script rather than
  new instructions.

BOARD: MERGE - one line added to an existing job in .github/workflows/lint.yml (the new script joins the same syntax-check list three others already use); no check weakened or removed.
EVIDENCE: python .github/check-workflows.py clean; bash -n on all four root scripts including the new one, matching exactly what the bash CI job runs.