Sweep Mail Legacy Hashes

One-shot, idempotent #1010 sweep: strip the legacy plain body_sha256 from the mail events and outbox lines of every ERASED subject. dry_run defaults to TRUE (counts + message ids only, no write); a real run needs dry_run: false, confirm: "mail-legacy-hashes" and a reason, which is recorded with the actor and the counts in the global audit log (erasure.mail_legacy_sweep). complete: false means the scan hit its cap: run it again.