Implement governed hybrid campaign delivery

tests/test_response_security.py

@@ -57,6 +57,14 @@ def _job() -> SimpleNamespace:
             }
         ],
         resolved_recipients={"to": [{"email": "person@example.test"}]},
+        resolved_print_output={
+            "output_sha256": "print-sha256",
+            "artifact": {
+                "filename": "letters.html",
+                "storage_key": "campaign/private/letters.html",
+                "download_path": "/api/v1/campaigns/campaign-1/versions/version-1/print-output/download",
+            },
+        },
     )
 
 
@@ -238,6 +246,13 @@ def test_ordinary_job_detail_and_attempts_do_not_expose_diagnostics() -> None:
     assert "claimed_at" not in job_payload
     assert "smtp_started_at" not in job_payload
     assert job_payload["attachments"] == [{"filename": "public.pdf"}]
+    assert job_payload["resolved_print_output"] == {
+        "output_sha256": "print-sha256",
+        "artifact": {
+            "filename": "letters.html",
+            "download_path": "/api/v1/campaigns/campaign-1/versions/version-1/print-output/download",
+        },
+    }
     assert "claim_token" not in attempts["smtp"][0]
     assert "claim_token" not in attempts["imap"][0]
     assert "smtp_response" not in attempts["smtp"][0]