Send an email from an instance's address

From ONE instance: the agent (api-key) names the holder_id whose instance it is writing from (the email_received envelope carried it) or omits it for the instance it holds itself; a holder sends from their own instance naming agent_id. Plain text only. Recipients must be the holder's own verified address or the instance's ACTIVE contacts; if any recipient is new or pending the whole send is held back (nothing is sent, the holder gets a Tasks item) and this answers 202 -- the draft is not stored, so send again after the email_contact_decided delivery. A holder whose chain root is under 7 days old may only write to addresses that wrote to the instance first WITH AUTHENTICATED MAIL (a forged inbound From does not count). A BLOCKED or UNSUBSCRIBED recipient answers exactly like a new one (202, nothing created), so the agent cannot learn who is blocked or opted out; during probation every non-own recipient gets the same 403 sentence before its status is looked at. Recipients who unsubscribed through the one-click link are never written to again from that instance, the holder's own address included. Ceilings, all or nothing: the instance (50 recipients a day), the holder's chain root (100), the agent's chain root (100), recipients who never wrote with authenticated mail (5 a day per holder root), and Salt as a whole (500, env-configurable; mail to the holder's own address does not draw on it). Each mail is sent as <agent name> via Salt with a one-click List-Unsubscribe that blocks the address on that instance. Attachments are plaintext bytes the agent decrypted itself; executables and macro-enabled files are refused. Daily cap per agent; bounces and complaints pause sending.