docs(campaign): define broker redelivery evidence

docs/CAMPAIGN_DELIVERY_RUNBOOK.md

@@ -118,9 +118,21 @@ The runner also terminates a dedicated OS process executing the registered
 Campaign send task after complete DATA, then invokes the task in a fresh
 process. The unfinished durable attempt must become `outcome_unknown` and the
 endpoint must observe no second connection or DATA transaction. This covers
-the worker task/process boundary. It does not cover Redis/Celery delivery,
-acknowledgement, broker redelivery, or daemon supervision; repeat the drill in
-that infrastructure before approving a production worker deployment.
+the worker task/process boundary but not a broker or daemon.
+
+Run `dev/mail-testbed/run_celery_redelivery_acceptance.py` for the maintained
+Redis/Celery delivery and broker redelivery boundary. It starts an isolated
+Redis Compose service and real Celery workers, kills the first solo worker after complete DATA while the
+late-ack task is unacknowledged, and requires the same task identity to reach a
+replacement worker after Redis visibility recovery. Passing evidence also
+requires durable `outcome_unknown`, an empty broker queue/unacked set, and
+exactly one SMTP connection and DATA transaction. Raw worker logs and task,
+database, endpoint, and credential identifiers are never retained.
+
+That second runner proves local runner-supervised process replacement, not the
+production process manager. Repeat the worker-loss drill under the selected
+systemd, container, Kubernetes, or other production supervisor and the target
+Redis/SMTP infrastructure before deployment approval.
 
 ## Reporting Checks