Add managed SMTP sink inspection

[chubes4]

Summary

• add provider-neutral host/smtp.inspect and host/smtp.reset recipe operations
• keep Mailpit details private, parse links locally without outbound link checking, and emit bounded opaque evidence
• reset host-side sinks between checkpointed adversarial cases and retain normalized replay evidence

Verification

• npm run build
• npm run test:runtime-services
• npm run test:runtime-services-lifecycle
• npx tsx tests/adversarial-recipe-orchestration.test.ts
• git diff --check

Fixes #2264.

AI assistance

• Model: GPT-5.6 Sol
• Tool: OpenCode
• Used for: implementation, provider/security review, and deterministic test execution. Chris Huber reviewed and remains responsible for every line.