Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003

- experiments/postfix-probe: Postfix 3.7 -> pipe -> mas-gateway -> ticket
  service in Docker; 14 address forms x 5 configurations. 13/14 arrive
  byte-identical everywhere; quoted "ticket=PR42" is unquoted in transit.
  Legacy bang/percent rewrites never fire for MAS addresses.
- docs/experiment-review.md: Email infrastructure section with results
- MAS-WP-0003: provider-side live test on a real subdomain (needs DNS/MX)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 623586@bnt-lap001
Assistant-Session: 10b30928-5b3b-4c11-9934-5ecca07367d8

experiments/postfix-probe/README.md

@@ -0,0 +1,29 @@
+# Postfix probe
+
+A real Postfix delivers MAS addresses through the `pipe` transport to
+`mas-gateway` and on to the reference ticket service. A capture proxy
+(`capture.py`) records the envelope recipient each event carried, so the
+probe can tell whether Postfix rewrote anything.
+
+```bash
+docker build -t mas-postfix-probe experiments/postfix-probe
+python3 experiments/postfix-probe/probe.py --profile defaults            # relay domain
+python3 experiments/postfix-probe/probe.py --profile local-domain        # domain in mydestination
+python3 experiments/postfix-probe/probe.py --profile local-domain-safe   # + swap_bangpath/percent_hack off
+```
+
+The other profiles are `defaults-local` and `mas-safe-local`. The repo is
+mounted read-only. In `results/` a `=` mark means the address arrived
+unchanged and `!` means it was rewritten. Findings are in
+`docs/experiment-review.md` under *Email infrastructure*.
+
+The Postfix side is the `master.cf` entry in `entrypoint.sh`:
+
+```
+mas  unix  -  n  n  -  -  pipe
+  flags=Rq user=mas argv=/usr/local/bin/mas-gateway --statute <statute>
+  pipe --app-url http://127.0.0.1:8024/mas-events --recipient ${recipient}
+```
+
+Set `mas_destination_recipient_limit = 1` so each pipe invocation handles
+one recipient.