Add ROADMAP; settle ADR 0005 with a measured OCI port test

cloud-1 (phx) and cloud-2 (us-sanjose-1) are both already OCI aarch64
instances, so the open question in ADR 0005 was answerable directly rather
than by reading forum posts. Measured from cloud-2:

  BLOCKED  25    gmail-smtp-in.l.google.com, aspmx.l.google.com
  OPEN     587/465/2525  gmail, sendgrid, SES, OCI Email Delivery

The community reports claiming 587 and 2525 are also blocked are wrong.
Only 25 is blocked, exactly as Oracle documents, so relay works and the
launch host is viable. Inbound :25 reachability is still unverified — that
is a VCN security-list change, not a platform limit.

ROADMAP.md carries the goal, three success signals that are deliberately
not v0.1, a definition-of-ready checklist, and five standing rules.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7

docs/adr/0005-oracle-cloud.md

@@ -34,11 +34,34 @@ Direct-to-MX (v0.4) is developed and tested on a host without the block.
   against a mechanism the provider does not honour and mail still fails SPF —
   silently. Same for Resend.
 
-## ⚠️ Open — verify before committing to the host
+## Measured, 2026-09-02 — the block is port 25 only
 
-Oracle's docs name only port 25. Mailcow community reports claim **587 and 2525
-are also blocked outbound on free tier**, which would make OCI unable to relay
-either, and would change the host choice entirely.
+Community reports claimed 587 and 2525 were also blocked, which would have made
+OCI unable to relay and changed the host choice entirely. Tested directly from
+our own OCI instance (cloud-2, `us-sanjose-1`, aarch64):
 
-**Test on a free instance before building on this.** It is a 20-minute check
-and it invalidates this ADR if the reports are right.
+```
+BLOCKED  25    gmail-smtp-in.l.google.com
+BLOCKED  25    aspmx.l.google.com
+OPEN     587   smtp.gmail.com
+OPEN     465   smtp.gmail.com
+OPEN     587   smtp.sendgrid.net
+OPEN     2525  smtp.sendgrid.net
+OPEN     587   email-smtp.us-east-1.amazonaws.com
+OPEN     587   smtp.email.us-sanjose-1.oci.oraclecloud.com
+```
+
+**The reports are wrong.** Only 25 is blocked, exactly as Oracle documents.
+Submission ports are open, including both relay providers we ship. The host is
+viable and this ADR stands.
+
+Note that cloud-1 (`phx`) and cloud-2 (`us-sanjose-1`) are both already OCI
+aarch64 instances — the same shape as the launch target, and the same
+architecture spark-1 builds for.
+
+### Still unverified
+
+**Inbound :25 reachability** has not been tested end-to-end. Oracle blocks
+outbound only, but the VCN security list and the instance firewall must still
+be opened before mail can arrive. That is a configuration change, not a
+platform limit.