feat(outbound): core contract, store resolution, mock/SMS migration (COD-398)

[shivros]

IRIS-11 PR1: Outbound attachments — core contract + store resolution + Mock/SMS migration (T2–T4)

Closes COD-398. First implementation slice of the add-outbound-attachments OpenSpec change (spec merged via #19 / COD-395).

What this does

• Breaking contract change: MessageProvider::send_message now takes &OutboundMessage { body, attachments } instead of &str.
• New iris-core::outbound module: OutboundMessage, OutboundAttachment (Bytes { mime_type, filename, bytes } | Stored(Uuid)), ResolvedAttachment, plus resolve_attachments and enforce_capability helpers.
• New ProviderCapability::SendAttachments: providers without it reject non-empty attachment lists with UnsupportedCapability before any external request. Text-only sends are behavior-identical to main.
• Store resolution: stored refs resolve via Arc<dyn AttachmentStore> at the provider boundary; a missing stored ID (or missing store) fails the send with no partial dispatch. Inline attachments validate (non-empty MIME, non-empty bytes) and never require a store.
• Mock: advertises SendAttachments, records complete outbound sends (body + resolved attachments) via recorded_sends() for deterministic round-trip tests; audit metadata stays content-free (mime/filename/byte_count only).
• SMS: rejects attachments (no SendAttachments); text behavior unchanged.
• Telegram/Email: compile under the new signature, text-only until their multipart slices (T5/T6 are PR2/PR3).
• Surfaces (CLI/MCP/HTTP): construct OutboundMessage::text(...) — attachment input expansion is T8–T10, a later PR.

Review panel findings (fixed)

• Reviewer B (GPT-5.5) caught that the mock rejected inline attachment sends when no store was configured — inline attachments don't need a store. Fixed in b7e6304: resolve_attachments now takes Option<&Arc<dyn AttachmentStore>>; stored refs fail fast, inline always resolve.
• Reviewer B also noted text-only audit metadata now includes attachment_count: 0 (and attachments: [] for mock). This is deliberate per the frozen design ("audit metadata contains attachment summaries only (count, MIME type, filename, and byte count)") and content-free. Flagging for reviewer awareness.
• Reviewer A (independent gate re-run) approved clean.

Verification

All five gates pass on this branch:

• cargo build --all-targets ✅
• cargo test --all-targets — 94 tests, 0 failures ✅
• cargo clippy --all-targets -- -D warnings ✅
• cargo fmt --all -- --check ✅
• cargo run -p iris-codegen --bin iris-codegen -- check ✅ (generated artifacts untouched by this PR)

Out of scope (follow-up slices)

• T5 Telegram multipart media sends (PR2)
• T6 Email MIME multipart sends (PR3)
• T7 partial-dispatch audit outcomes (lands with Telegram PR2)
• T8–T10 generated surface attachment inputs

Draft — awaiting Siobhan's review. Do not merge automatically.

[shivros]

🤖 Automated Review Panel

Dual-model review before opening this PR. Reviewer A re-ran the verification gates independently; Reviewer B performed a diff-only second opinion.

---

Reviewer A (frontier reasoning model, gate re-run)

Verdict: ✅ APPROVE

All frozen contract requirements for PR1 are correctly implemented, and I independently re-ran every gate on the branch (runner/COD-398-outbound-core, clean tree): cargo test --all-targets (all suites green), cargo clippy --all-targets -- -D warnings (clean), iris-codegen check (OK).

Contract compliance verified:

• Core signature change (send_message(&OutboundMessage)) applied across trait, all four providers, and all three surfaces
• Capability gating rejects attachments pre-dispatch for providers without SendAttachments
• Stored-reference resolution failures abort the send with no partial dispatch
• Audit metadata stays content-free (mime/filename/byte_count summaries only)
• Text-only send paths behavior-identical to main

---

Reviewer B (second-opinion diff review)

Verdict: ⛔ BLOCK → resolved

Finding (fixed in b7e6304): MockProvider advertised SendAttachments but rejected all non-text-only sends when no attachment store was configured — including inline Bytes attachments, which never need a store. The doc comment even claimed "inline attachments still work" while the implementation returned IrisError::Config for them. Also prevented inline validation from running on that path.

Fix: resolve_attachments now takes Option<&Arc<dyn AttachmentStore>>. Inline variants validate in place and always resolve; only Stored(Uuid) references require a store and fail fast with a config error when absent. New test mock_without_store_accepts_inline_attachments covers the gap.

Noted, accepted: text-only audit metadata now includes attachment_count: 0 (mock also adds attachments: []). Deliberate per the frozen design's audit-summary requirements; content-free. Flagged in the PR description for reviewer awareness.

---

Both reviewers' blocking findings are addressed; all five gates green at b7e6304 (94 tests).