Check release version compat

To move into a better position to align this project with nixpkgs
unstable breaking changes we now default to require a matching nixpkgs
release.

mail-server/assertions.nix

@@ -3,7 +3,34 @@
   lib,
   ...
 }:
+
+let
+  mailserverRelease = "25.11";
+  nixpkgsRelease = lib.trivial.release;
+  releaseMismatch =
+    config.mailserver.enableNixpkgsReleaseCheck && mailserverRelease != nixpkgsRelease;
+in
+
 {
+  warnings = lib.optional releaseMismatch ''
+    You are using
+
+      NixOS Mailserver version ${mailserverRelease} and
+      Nixpkgs version ${nixpkgsRelease}.
+
+    Using mismatched versions is likely to cause compatibility issues
+    and may require migrations that make an eventual rollback tricky.
+
+    It is therefore highly recommended to use a release of
+    NixOS mailserver that corresponds with your chosen release of Nixpkgs.
+
+    If you insist then you can disable this warning by adding
+
+      mailserver.enableNixpkgsReleaseCheck = false;
+
+    to your configuration.
+  '';
+
   # We guard all assertions by requiring mailserver to be actually enabled
   assertions = lib.optionals config.mailserver.enable (
     [