feat: add structured attachments and triage contracts

[nonozone]

Summary

Make high-value mailbox context usable by agents without turning heuristic judgments into parser facts.

This adds first-class inbound MIME attachment metadata and a versioned triage contract that separates deterministic message/thread evidence from optional external enrichment. MailCLI still makes no provider calls in core.

What changed

• StandardMessage.attachments now reports MIME part id, untrusted filename, content type, decoded size, disposition, content id, and inline status without embedding attachment bytes.
• mailcli triage message and mailcli triage thread produce compact deterministic evidence, including one fact entry per thread message so earlier unresolved requests remain visible.
• External priority, needs_reply, deadline, and todo enrichment is strictly validated for source, timestamp, confidence, reasons, message traceability, and exact evidence_id match.
• Safe triage evidence tools are available through MCP plus the OpenAI and Anthropic tool schemas.
• English and Chinese specs distinguish contract snapshots from the separately required human-labeled provider evaluation process.

flowchart TB
  A["Raw RFC 822 email"] --> B["Go parser"]
  B --> C["StandardMessage plus attachment metadata"]
  C --> D["Deterministic triage evidence"]
  D --> E["External provider"]
  E --> F["Enrichment with evidence_id"]
  F --> G["Go validation and merged TriageRecord"]

Loading

The evidence hash is important: enrichment generated before a thread changes is rejected instead of being silently attached to newer context.

Verification

• go test ./...
• go vet ./...
• go build -o /tmp/mailcli-issue-4-5 ./cmd/mailcli
• make demo-local-thread-check
• jq empty tools/openai.json tools/anthropic.json
• git diff --check
• specability validate docs/specability/README.md
• specability reconcile docs/specability/README.md

Specability remains aligned with its existing advisory warning about the missing Adversarial Surfaces section.

Post-Deploy Monitoring & Validation

• Validation window: first dogfood/release cycle after merge; owner: repository maintainer.
• Healthy signals: attachment fixtures expose metadata but no encoded content; triage message/thread outputs include deterministic evidence and stable evidence_id; current enrichment merges successfully.
• Watch CLI/MCP errors for invalid triage enrichment, evidence_id does not match, and source_message_id is not present to distinguish provider contract drift from parser failures.
• Failure trigger: valid current-context enrichment is rejected, attachment bytes appear in JSON, or a stale enrichment is accepted after thread evidence changes.
• Mitigation: disable enrichment merge in the caller while retaining deterministic evidence; rollback by reverting this PR or using the previous MailCLI binary.

Closes #4
Closes #5

---

🤖 Generated with GPT-5 (Codex context, extended reasoning) via Codex