Test MAS addresses against real Postfix; close MAS-WP-0002, add MAS-WP-0003

- experiments/postfix-probe: Postfix 3.7 -> pipe -> mas-gateway -> ticket
  service in Docker; 14 address forms x 5 configurations. 13/14 arrive
  byte-identical everywhere; quoted "ticket=PR42" is unquoted in transit.
  Legacy bang/percent rewrites never fire for MAS addresses.
- docs/experiment-review.md: Email infrastructure section with results
- MAS-WP-0003: provider-side live test on a real subdomain (needs DNS/MX)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 623586@bnt-lap001
Assistant-Session: 10b30928-5b3b-4c11-9934-5ecca07367d8

experiments/postfix-probe/capture.py

@@ -0,0 +1,40 @@
+"""Probe-only proxy: records each MAS event as delivered by Postfix, then
+forwards it to the ticket service and records the app's answer."""
+
+import json
+import sys
+import urllib.error
+import urllib.request
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+UPSTREAM = sys.argv[1]
+EVENTS = []
+
+
+class H(BaseHTTPRequestHandler):
+    def do_POST(self):
+        body = self.rfile.read(int(self.headers.get("Content-Length", "0")))
+        req = urllib.request.Request(UPSTREAM, body, {"Content-Type": "application/json"})
+        try:
+            with urllib.request.urlopen(req) as r:
+                status, resp = r.status, r.read()
+        except urllib.error.HTTPError as e:
+            status, resp = e.code, e.read()
+        EVENTS.append({"event": json.loads(body), "app_status": status, "app": json.loads(resp or b"null")})
+        self._send(status, resp)
+
+    def do_GET(self):
+        self._send(200, json.dumps(EVENTS).encode())
+
+    def _send(self, status, body):
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        self.wfile.write(body)
+
+    def log_message(self, *a):
+        pass
+
+
+ThreadingHTTPServer(("0.0.0.0", 8024), H).serve_forever()