P1: Light up the email channel — SES worker, sending enabled, delivery ledger

[krishagel]

Problem

PSD EOC is an emergency notification platform that cannot currently send an
emergency notification. Email is the closest channel to working and should be
first.

Current state per docs/INTEGRATIONS.md:

• SES production access is enabled in account 338414773271, us-west-2
• The psd401.net domain identity is verified
• The psd-eoc-transactional configuration set exists with
  SendingEnabled=false
• Neither the App Runner role nor the worker role holds any ses: permission
• No executable email worker is deployed

So the plumbing is defined but deliberately dark, and the code to light it up
was never finished.

What to build

1. Deploy the email worker. workers/email/ consumes the outbox queue and
   calls SES. Give its task role exactly ses:SendEmail and
   ses:SendRawEmail, scoped to the psd-eoc-transactional configuration set
   and the eoc-alerts@psd401.net sender.
2. Enable sending on the configuration set.
3. Delivery ledger. Persist per-recipient send attempts and outcomes.
   Provider acceptance is not human receipt — keep them distinct states, and
   keep unknown as a first-class value.
4. Consume SES events (bounce, complaint, delivery) from the existing
   encrypted SNS topic and record them against the ledger.
5. Retry and DLQ. Bounded retries with backoff; permanent failures land in
   the DLQ with the alarm already defined in infra/.
6. Suppression. Honor bounces and complaints — never retry a hard bounce.

Safety

Real sends to real staff are a human-only action (AGENTS.md §2). The send
path stays behind an authenticated human confirming a consequence preview in
the app that states exactly how many people will be emailed. No agent, test, or
scheduled job may trigger a real send.

First real send is a single recipient — Kris — chosen at action time, confirmed
in-app.

Done when

• A drill event addressed to one confirmed recipient produces a real email.
• The ledger records queued → accepted → delivered, and bounces land correctly.
• The DLQ alarm fires on a forced failure.
• A drill renders unmistakably as a drill (AGENTS.md §3).