test(04-04): close mail safety and Mailpit SMTP receipt coverage

- Assert memory recipients, HTML safety, and SMTP TLS without credential leaks
- Prove real SMTP delivery through Mailpit HTTP API when Docker is available
- Add scripts/check-phase4.sh as the phase vet, test, race, and SMTP gate

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/hello/hello_test.go

@@ -179,6 +179,13 @@ func TestHelloPluginSendsMail(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
+	err = mail.Send(t.Context(), postcard.Message{
+		Template: "golem15.hello::mail.does-not-exist",
+		To:       []string{"ada@example.test"},
+	})
+	if err == nil || !strings.Contains(err.Error(), "golem15.hello::mail.does-not-exist") {
+		t.Fatalf("unknown template error = %v", err)
+	}
 }
 
 func TestTypedItemRoute(t *testing.T) {