fix: address external audit — criticals 1-5 + mediums

Critical 1 (approval forgery): audit_log is now hash-chained
(prev_hash/entry_hash, verify_audit_chain); executor approve REQUIRES a
BIP-340 signature over sha256(cayce-ops:approve:<id>) when
CAYCE_OPS_OPERATOR_PUBKEY is set; deploy/roles.sql ships least-privilege
per-daemon DB roles.

Critical 2 (threading dead): sends create real OUTBOUND rows (own
Message-ID, In-Reply-To -> inbound); inbound message_id never overwritten;
maild compose adds the first-contact path; _match_proposal falls back to
inbound chains.

Critical 3 (duplicate sends): per-message transactions in send path —
SMTP failure on message N no longer resurrects 1..N-1; failures audited
(send_failed) and the row stays queued.

Critical 4 (classifier): negated approvals (cannot accept / not approved /
not accepting) classify REJECTION at 0.95 before the bare-keyword rule;
LLM prompt braces escaped (.format no longer KeyError into silent fallback).

Critical 5 (systemd): every daemon has a run subcommand
(maild run = poll+send, publisher run = publish-due, monitor run = build);
deploy README documents the separate daily publisher plan timer.

Mediums: approved_hash binds drafts/captions to the approved text (edited
text refuses to send/publish until re-approved); risk_score renamed
match_score (migration 0002) and auto-approve orders HIGHEST relevance
first; compose binds postgres to 127.0.0.1; IMAP marks \\Seen only after
commit (fetch returns (num, raw), mark post-commit); disabled channels are
terminal (ContentStatus.SKIPPED) and publish failures burn a bounded
attempt budget before abandonment; make hooks installs the pre-push gate.

tests: 12 new — 56 total, all green; ruff 0 findings; gitleaks clean.

docs/DECISIONS.md

@@ -69,3 +69,29 @@ An action plugin is a Python function registered in
 `http_post` exists but is inert unless `CAYCE_OPS_ENABLE_HTTP_ACTIONS=true`.
 *Cost:* no sandboxing of plugins — plugins are repo code, reviewed like
 everything else.
+
+## D10 — Audit chain is hash-chained; approval can require operator signature (post-audit)
+`audit_log` rows chain sha256(prev_hash|fields); `verify_audit_chain` walks it,
+the monitor can surface breaks. With `CAYCE_OPS_OPERATOR_PUBKEY` set,
+`executor approve` REQUIRES a BIP-340 signature over
+sha256("cayce-ops:approve:<id>") from the operator key — `--actor` becomes a
+label, the key is the proof (the audit's "anyone can sign as anyone").
+*Cost:* without a pubkey configured the gate degrades to the old free-text
+actor; separate DB roles per daemon remain a deployment TODO (SQL to tighten
+ships in deploy/roles.sql).
+
+## D11 — Mail threading now has a real first-contact path (post-audit)
+Sends create an OUTBOUND row (own Message-ID, In-Reply-To -> inbound);
+inbound rows keep their original Message-ID. `maild compose` creates the
+initial outreach draft for a proposal. Approval is bound to the draft text
+via sha256 (`approved_hash`): an edited draft refuses to send until
+re-approved. Each send commits in its own transaction — SMTP failure on
+message N can no longer resurrect 1..N-1 as duplicates.
+
+## D12 — IMAP \\Seen only after commit; content gates tighten (post-audit)
+Messages are fetched unmarked and flagged \\Seen after the processing
+transaction commits (crash mid-batch no longer loses mail). Publisher:
+caption hash-bound at approval, disabled channels are terminal (`SKIPPED`),
+publish failures burn a bounded attempt budget before abandonment.
+`risk_score` renamed `match_score` (keyword relevance) and auto-approval
+takes the HIGHEST score first.