feat: add governed postbox delivery and report hardening

tests/test_mail_profile_boundary.py

@@ -73,7 +73,7 @@ def test_mail_profile_documentation_is_classified_for_adaptive_views() -> None:
 def test_campaign_mail_contract_rejects_every_legacy_server_field(legacy_key: str) -> None:
     raw = _campaign_json({"mail_profile_id": "profile-1", legacy_key: {}})
 
-    with pytest.raises(CampaignMailProfileBoundaryError, match="select an authorized Mail profile"):
+    with pytest.raises(CampaignMailProfileBoundaryError, match="select authorized Mail resources"):
         assert_campaign_uses_mail_profile_reference(raw)
 
 
@@ -138,7 +138,7 @@ def test_new_execution_snapshot_stores_reference_and_evidence_not_transport_mate
         delivery=DeliveryConfig(),
     )
 
-    assert payload["snapshot_version"] == "5"
+    assert payload["snapshot_version"] == "7"
     assert payload["mail_profile_id"] == "profile-1"
     assert "smtp" not in payload
     assert "imap" not in payload