test(04-04): close mail safety and Mailpit SMTP receipt coverage

- Assert memory recipients, HTML safety, and SMTP TLS without credential leaks
- Prove real SMTP delivery through Mailpit HTTP API when Docker is available
- Add scripts/check-phase4.sh as the phase vet, test, race, and SMTP gate

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/check-phase4.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Repeatable Phase 4 verification: root vet/test including Mailpit SMTP
+# receipt, nested hello app vet/test, and a focused race run.
+# Docker is required; unavailable Docker is a failed gate, never a skip.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+if ! command -v docker >/dev/null 2>&1; then
+	echo "refuse: docker is required for Phase 4 Mailpit" >&2
+	exit 1
+fi
+if ! docker info >/dev/null 2>&1; then
+	echo "refuse: docker daemon is not available" >&2
+	exit 1
+fi
+
+echo "==> docker is available"
+
+echo "==> root go vet"
+go vet ./...
+
+echo "==> root go test (includes Mailpit SMTP receipt)"
+go test ./...
+
+echo "==> hello go vet"
+go -C examples/hello vet ./...
+
+echo "==> hello go test"
+go -C examples/hello test ./...
+
+echo "==> race internal/build phrasebook postcard"
+go test -race ./internal/build ./phrasebook ./postcard
+
+echo "phase4 check passed"