EMAIL-WP-0005-T04: end-to-end send-and-scan tests, and two fixes they found

Adds tests/test_integration_send_scan.py: 7 harness-gated cases covering
delivery and Message-ID correlation, scanner ingestion without a delivery
claim, idempotency, resend, suppression, rejected requests never reaching the
provider, and verification mail carrying no authorization.

Fixes the reply heuristic, which matched against headers as well as body. The
Received: trace that every MTA-handled message carries matched its "received"
keyword, so ordinary mail was classified human_reply with a
success.reply_received assessment at medium confidence -- the exact overclaim
this repo exists to prevent. Hand-written fixtures have no Received headers,
so only real scanned mail exposed it. The heuristic now takes the body alone;
DSN detection still sees headers, which it needs. Regression test is offline.

Fixes the provider reference: SMTPProvider set no Message-ID, so send() fell
back to abs(hash((recipient, subject))) -- randomized per process and colliding
for equal recipient/subject. Outgoing mail now carries a proper RFC 5322
Message-ID, returned as the reference, which is what makes send-to-scan
correlation testable.

Suite: 72 passed with the harness up, 62 passed + 10 skipped with it down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/EMAIL-WP-0005-test-mailbox-harness.md

@@ -264,7 +264,7 @@ Done 2026-08-14:
 
 ```task
 id: EMAIL-WP-0005-T04
-status: todo
+status: done
 priority: high
 state_hub_task_id: "69655fad-97b8-4c17-bc54-af341aaaf38c"
 ```
@@ -288,6 +288,36 @@ An integration run proves send-to-scan continuity against a live local server,
 while the default test run remains offline, deterministic, and unchanged.
 ```
 
+Done 2026-08-14:
+
+* `tests/test_integration_send_scan.py`, 7 harness-gated cases: accepted
+  invitation reaches the mailbox and correlates by Message-ID; scanner ingests
+  it without a delivery claim; duplicate event sends once and returns the same
+  reference; resend delivers a second distinct message; suppressed recipient
+  receives nothing; unauthorized / template-denied / key-mismatch requests never
+  reach the provider; verification mail delivers and reports
+  `authorization=false`.
+* Suite: 72 passed with the harness up, 62 passed + 10 skipped with it down.
+
+Two production defects surfaced, both invisible to the fixture-only suite:
+
+* **Reply heuristic matched message headers.** `_looks_like_human_reply` ran
+  against headers plus body, so the `Received:` trace that every MTA-handled
+  message carries matched its "received" keyword. Ordinary mail was classified
+  `human_reply` with a `success.reply_received` assessment at medium confidence
+  — exactly the overclaim this repo exists to prevent. Hand-written fixtures
+  carry no `Received:` headers, which is why only real scanned mail exposed it.
+  The heuristic now takes the body alone; DSN detection still sees headers,
+  which it needs. Same message before/after: `human_reply`/medium →
+  `unknown_return_message`/low. Regression test is offline
+  (`tests/fixtures/mailbox_transit/ordinary_transit.eml`).
+* **Provider reference was not a real reference.** `SMTPProvider.send` fell back
+  to `abs(hash((recipient, subject)))` because it set no `Message-ID`. Python
+  randomizes string hashing per process, and equal recipient/subject pairs
+  collided. Outgoing mail now carries a proper RFC 5322 `Message-ID`, which is
+  returned as the reference — so an accepted send can be tied to a message
+  later observed in a mailbox. This is what makes correlation testable at all.
+
 ## T05 - Bounce, complaint, and deferral realism
 
 ```task