ClamAV replicas share SelfCheck, so signature reloads can coincide

Deferred from the ClamAV work on #184 (`codingjoe-turbo-spoon`).

builderJoe defer line: `defer: the two clamav replicas have no per-replica SelfCheck offset, so replicas started together reload at the same time. Split into two services with offset SelfCheck if that shows up. [compose.production.yml]`

## What

`clamav` runs `deploy.replicas: 2` with `CLAMD_CONF_ConcurrentDatabaseReload: "no"`. With that setting a reload blocks scanning on the replica doing it, which is why the second replica exists.

Both replicas share the default `SelfCheck` of 600 s, and Compose offers no per-replica env override, so replicas started in the same deploy can enter their reload window together. During an overlap, one message can fail on both addresses, emit `CLAM_VIRUS_FAIL`, and be answered `soft reject`.

## Impact

Low. The scan retries for about a day (`SPAM_SCAN_RETRY`, 40 attempts), so a coinciding reload delays a message rather than losing it. It is a delay, not a hole: nothing is delivered unscanned.

## Fix

Split into two explicit services with offset `CLAMD_CONF_SelfCheck` values. The image rewrites the default `#SelfCheck 600` line from `CLAMD_CONF_SelfCheck`, so the knob is real. Not worth the extra service today.

Alternatively, accept it: the retry budget already covers the overlap.