docs(campaign): define target-like mail evidence

dev/mail-testbed/README.md

@@ -44,6 +44,57 @@ If the smoke is started immediately after `docker compose up -d`, GreenMail may
 bind the SMTP/IMAP ports before the services are fully ready. The smoke retries
 login and folder setup for `GOVOPLAN_MAIL_TEST_READY_TIMEOUT_SECONDS`.
 
+## Campaign Acceptance
+
+The transport smoke proves the Mail adapters. The Campaign acceptance runner
+proves the public composition: it creates an isolated temporary Core database,
+creates a Mail-owned encrypted profile through the API, materializes the
+credential-free [`greenmail-delivery`](../../examples/greenmail-delivery/campaign.json)
+fixture with only that profile reference, validates/builds it, sends the exact
+generated EML through Campaign once, appends it once, and cross-checks Campaign
+report/audit state with one unique-subject message in the GreenMail INBOX and
+Sent folders. Provider mailbox verification is not a byte-for-byte comparison
+after provider-side header or storage transformations.
+
+```bash
+cd /mnt/DATA/git/govoplan-campaign/dev/mail-testbed
+set -a
+. ./.env
+set +a
+/mnt/DATA/git/govoplan/.venv/bin/python run_campaign_acceptance.py \
+  --evidence /tmp/govoplan-campaign-greenmail-evidence.json
+```
+
+The default run also uses controlled loopback protocol endpoints to prove that
+an SMTP connection loss before transmission is temporary, an explicit SMTP
+authentication rejection is permanent, and an IMAP authentication rejection
+after SMTP acceptance leaves the send accepted while the append fails. A
+second ordinary send must be rejected before another provider effect.
+
+The bounded JSON contains no endpoint, account, address, credential, profile,
+campaign, version, or job identifiers. It records module versions, the fixture
+hash, normalized classifications/counts, the Mail-profile boundary, required
+audit actions, provider mailbox increments, and coverage flags. Runtime version
+declarations identify the exercised composition; they do not claim that the
+sources are clean, tagged, signed, or release-provenanced. The evidence names
+them `declared_module_versions` and keeps `source_artifact_provenance` false;
+exact commit/artifact provenance belongs to the package and release gate.
+
+This runner is restricted to literal loopback IP addresses and the synchronous
+Campaign delivery mode. Hostnames such as `localhost` and every non-loopback
+address fail before profile creation, avoiding a DNS change between validation
+and connection. It is local target-like evidence, not approval of an
+institution's SMTP/IMAP service. A post-DATA connection loss
+with ambiguous SMTP outcome, an explicit temporary SMTP response, partial
+recipient refusal, and a real worker restart remain separate drills and are
+explicitly `false` in the coverage projection. Use `--success-only` only when
+testing the success journey without the local failure endpoints.
+
+Starting the maintained test bed requires a working Docker CLI, Compose plugin,
+daemon/socket access, and permission to pull `greenmail/standalone:2.1.9`. The
+Campaign runner needs only the already-running loopback endpoints; it neither
+starts Docker nor claims that it did.
+
 ## Use With A Campaign
 
 Use the same settings in a campaign mail profile: