fix: address external audit — criticals 1-5 + mediums

Critical 1 (approval forgery): audit_log is now hash-chained
(prev_hash/entry_hash, verify_audit_chain); executor approve REQUIRES a
BIP-340 signature over sha256(cayce-ops:approve:<id>) when
CAYCE_OPS_OPERATOR_PUBKEY is set; deploy/roles.sql ships least-privilege
per-daemon DB roles.

Critical 2 (threading dead): sends create real OUTBOUND rows (own
Message-ID, In-Reply-To -> inbound); inbound message_id never overwritten;
maild compose adds the first-contact path; _match_proposal falls back to
inbound chains.

Critical 3 (duplicate sends): per-message transactions in send path —
SMTP failure on message N no longer resurrects 1..N-1; failures audited
(send_failed) and the row stays queued.

Critical 4 (classifier): negated approvals (cannot accept / not approved /
not accepting) classify REJECTION at 0.95 before the bare-keyword rule;
LLM prompt braces escaped (.format no longer KeyError into silent fallback).

Critical 5 (systemd): every daemon has a run subcommand
(maild run = poll+send, publisher run = publish-due, monitor run = build);
deploy README documents the separate daily publisher plan timer.

Mediums: approved_hash binds drafts/captions to the approved text (edited
text refuses to send/publish until re-approved); risk_score renamed
match_score (migration 0002) and auto-approve orders HIGHEST relevance
first; compose binds postgres to 127.0.0.1; IMAP marks \\Seen only after
commit (fetch returns (num, raw), mark post-commit); disabled channels are
terminal (ContentStatus.SKIPPED) and publish failures burn a bounded
attempt budget before abandonment; make hooks installs the pre-push gate.

tests: 12 new — 56 total, all green; ruff 0 findings; gitleaks clean.

cayceops/cli.py

@@ -71,10 +71,16 @@ def executor_run() -> None:
 
 @executor_app.command("approve")
 def executor_approve(
-    proposal_id: int, actor: str = typer.Option(..., help="Human approver id")
+    proposal_id: int,
+    actor: str = typer.Option(..., help="Human approver id"),
+    signature: str = typer.Option(
+        None, help="BIP-340 sig (required when operator pubkey is set)"
+    ),
 ) -> None:
     """Approve a proposal (human action, audited)."""
-    raise typer.Exit(_load_component("executor").approve(proposal_id, actor))
+    raise typer.Exit(
+        _load_component("executor").approve(proposal_id, actor, signature=signature)
+    )
 
 
 @executor_app.command("reject")
@@ -102,10 +108,33 @@ def maild_approve(msg_id: int, actor: str = typer.Option(...)) -> None:
 
 @maild_app.command("send-approved")
 def maild_send() -> None:
-    """Send all approved drafts via SMTP."""
+    """Send all approved drafts via SMTP (per-message commit)."""
     raise typer.Exit(_load_component("maild").send_approved())
 
 
+@maild_app.command("compose")
+def maild_compose(
+    proposal_id: int,
+    to_addr: str = typer.Option(...),
+    subject: str = typer.Option(...),
+    body: str = typer.Option(...),
+) -> None:
+    """Create the FIRST-CONTACT outbound draft for a proposal (drafted)."""
+    raise typer.Exit(
+        _load_component("maild").compose(proposal_id, to_addr, subject, body)
+    )
+
+
+@maild_app.command("run")
+def maild_run() -> None:
+    """One daemon cycle: poll inbound, then send approved drafts."""
+    comp = _load_component("maild")
+    code = comp.poll()
+    if code == 0:
+        code = comp.send_approved()
+    raise typer.Exit(code)
+
+
 # --- publisher ---------------------------------------------------------------
 publisher_app = typer.Typer(name="publisher", help="Themed content calendar")
 app.add_typer(publisher_app)
@@ -135,6 +164,12 @@ def publisher_publish() -> None:
     raise typer.Exit(_load_component("publisher").publish_due())
 
 
+@publisher_app.command("run")
+def publisher_run() -> None:
+    """One daemon cycle: publish due approved items (plan is cron'd separately)."""
+    raise typer.Exit(_load_component("publisher").publish_due())
+
+
 # --- monitor -----------------------------------------------------------------
 monitor_app = typer.Typer(name="monitor", help="Static status page")
 app.add_typer(monitor_app)
@@ -146,6 +181,12 @@ def monitor_build() -> None:
     raise typer.Exit(_load_component("monitor").build())
 
 
+@monitor_app.command("run")
+def monitor_run() -> None:
+    """One daemon cycle: build the status page."""
+    raise typer.Exit(_load_component("monitor").build())
+
+
 def main() -> None:  # pragma: no cover
     app()