Add SwiftMail provider qualification harness - #308

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/swiftmail-provider-qualification.yml:
- Around line 116-122: Update the custom shell configuration at
.github/workflows/swiftmail-provider-qualification.yml:36 to use errexit and
pipefail (for example, zsh -e -o pipefail {0}), ensuring assertion failures
propagate in both the provider qualification script at lines 116-122 and the
version/revision assertions at lines 49-53; no direct changes are required at
either script site.
- Around line 49-53: Update the workflow’s custom zsh shell configuration at the
`defaults.run.shell` setting to enable `errexit` and `pipefail`, using `zsh -e
-o pipefail {0}` or equivalent script flags. Preserve both `resolved_version`
and `resolved_revision` assertions so either mismatch fails the qualification
step.
- Around line 38-41: Pin both third-party actions in
.github/workflows/swiftmail-provider-qualification.yml to immutable full commit
SHAs: update actions/checkout at lines 38-41 and actions/upload-artifact at
lines 101-103 to the intended release SHAs, preserving trailing version
comments.

In `@docs/qualification/swiftmail-provider.md`:
- Around line 1-3: Update the terminology in the SwiftMail qualification
documentation: replace “provider qualification” with “Provider Compatibility
Run,” refer to dedicated accounts as “Provider Test Mailboxes/Tenants,” and call
generated redacted JSON “Mail Test Evidence.” Apply these terms consistently
throughout the document, including the additionally referenced section.

In `@README.md`:
- Line 171: Update the README provider-run section to use the canonical terms
“Provider Compatibility Run,” “Provider Test Mailboxes/Tenants,” and “Mail Test
Evidence,” or explicitly define “provider qualification” as their alias in
CONTEXT.md. Also state that this boundary is owned by Apple/Swift and remains
separate from the TypeScript validation commands, keeping terminology aligned
with the Swift package, workflow, and runbook.

In
`@tools/swiftmail-provider-qualification/Sources/swiftmail-provider-qualification/main.swift`:
- Around line 5-7: Resolve the executable entry-point conflict by renaming
main.swift to SwiftMailProviderQualificationCommand.swift while retaining the
`@main` annotation on SwiftMailProviderQualificationCommand.

In
`@tools/swiftmail-provider-qualification/Sources/SwiftMailProviderQualification/ProviderQualificationRunner.swift`:
- Around line 55-59: Make the final imap.disconnect() in
ProviderQualificationRunner’s qualification flow best-effort: catch and suppress
disconnect errors after cleanup completes, then set passed = true regardless of
disconnect success. Keep qualification failures and cleanup error handling
unchanged.
- Around line 218-226: Update the complete-history backfill handling around
validateBackfill and the "complete-history backfill" QualificationCheck to
explicitly record its decoded-bytes exemption and bound. Preserve the direct
metrics assignment only if it clearly documents that decodedBytes is
intentionally unevaluated and capped by the stated 5 MiB maximum; otherwise use
the existing recordBudgetedMetrics mechanism with the appropriate explicit
exemption, and update the check detail/report to state the bound.
- Around line 918-920: Update isSeen(_:) to check message.flags for direct
Flag.seen membership using contains(.seen), replacing the description-string
comparison while preserving the existing Boolean result.

In
`@tools/swiftmail-provider-qualification/Sources/SwiftMailProviderQualification/QualificationMessages.swift`:
- Around line 39-56: Update paddedMessage to include a valid RFC 5322 Date
header alongside the existing From header, using the project’s established
date-formatting mechanism if available. Extend the message tests to verify the
Date header is present and correctly formatted without changing the existing
padding or byte-count behavior.

In
`@tools/swiftmail-provider-qualification/Sources/SwiftMailProviderQualification/QualificationMetrics.swift`:
- Around line 60-64: Replace the lifetime high-water-mark implementation in
peakResidentMemoryBytes with a current resident-memory query using task_info,
updating both measure call sites to use that current-size helper and adding the
MachO import if required for the Mach symbols. Preserve the existing Int64
return type and zero fallback when the query fails so sequential measurements
independently report memory increases.
- Around line 21-28: Update the heartbeat and qualification measurement flow so
mainThreadStallMilliseconds captures main-actor execution caused by the measured
operation: run the relevant work on MainActor, including
ProviderQualificationRunner or IMAPServer operations as needed, before recording
stalls. Do not leave the metric measuring unrelated scheduling delay;
alternatively, explicitly document it as harness-only evidence and avoid
applying QualificationBudget.adr0027 to it.

In
`@tools/swiftmail-provider-qualification/Tests/SwiftMailProviderQualificationTests/QualificationTests.swift`:
- Around line 7-22: The test
configurationNamesMissingProtectedValuesWithoutEchoingSecrets currently discards
the error and does not exercise a secret-bearing environment. Update its iCloud
case to provide a known password while omitting the email variable, capture the
thrown error’s localizedDescription, and assert it names the missing email
variable without containing the supplied password.