Worker cutover: remove Postfix / local_mta

Before upgrading agents to 3.x or running the 20260803140000_direct_mx_and_relay_fleet migration in production:

1. Drain every worker Postfix queue

On each worker VPS:

postqueue -p            # must show an empty queue (Mail queue is empty)
postfix flush           # force a queue run if anything remains
# wait, then re-check
postqueue -p

Do not purge Postfix or upgrade the agent while the queue still holds messages. The platform cannot see those messages; re-dispatching via direct MX would deliver twice.

2. Apply the platform migration

The migration cancels any remaining queued_local jobs and defers their recipients with a visible cutover lastError. Recipients retry via direct MX after five minutes — only after you have confirmed empty queues.

3. Re-provision workers

Next provision (or re-run the install script) removes Postfix, rsyslog, and SASL packages and installs the 3.x agent (direct MX + authenticated next-hop only).

4. Bounce path

Late DSNs arrive via the SRS bounce domain (bounce.<MAIL_HOST>), not agent mail.log scraping. Confirm inbound SMTP accepts that domain and EgressBounceService.reportSrsBounce is wired before deleting agent bounce scanning.