PHASE-006: reader integrity, safe message repair, and 1.3.4-rc.1 live acceptance

[victorsteele]

PHASE-006

This PR prepares MailStack 1.3.4-rc.1 for controlled live acceptance.

Included

• Fix raw CSS leakage in style-heavy HTML emails
• Preserve safe HTML sanitization and sandbox/no-referrer protections
• Remove blocked remote-image residue
• Add bounded dry-run-first existing-message body repair
• Preserve message identity, state, source identity, and attachments
• Disable the unused Gunicorn control interface without weakening systemd confinement
• Prepare 1.3.4-rc.1 prerelease identity and release metadata

Preserved boundaries

• No database migration
• No Postfix/Dovecot/LMTP routing change
• No authorization redesign
• No outbound mail functionality
• No PHASE-007 broad UI redesign

Qualification

Implementation commit:
90175b7

Release identity commit:
df1a3f0

Branch CI:
https://github.com/vibtools/MailStack/actions/runs/32193469191

Result: PASS

Remaining gates

• PR CI
• merge to main
• exact main push CI
• v1.3.4-rc.1 tag
• automated GitHub prerelease publication
• controlled VPS upgrade
• repair dry-run / bounded repair
• reader + Gunicorn live acceptance