v0.4.0 — obstat_subject, what a call did, which policy said so

Everything here came out of running obstat in front of three real mailboxes.
Schema 4 → 5.

• The injected caller identity moved from subject to obstat_subject.
  Reserving the bare word took it from every tool that had a use for it — an
  email tool wants send_email(to, subject, body), and the failure was silent:
  the parameter vanished from the advertised schema and a Subject object
  landed in the Subject: header. obstat_ is now the only reserved prefix,
  and a tool still declaring the old spelling is refused at decoration rather
  than handed None for ever.
• obstat.note(...) — a tool can record what the call did, not only what
  it was allowed to do. A bulk delete records one sender whether it removed one
  message or ten thousand; now the body can say deleted=154, matched=158, on
  failure too, since half a bulk delete is the case a reader most needs a
  number for.
• Every decision that consulted policy carries a policy digest over the
  bytes of the file, so rule 2 still means something after the file is edited
  and the numbering shifts.
• error on outcome records is the exception's __qualname__ — IMAP4.error,
  not error.
• §8 now leads with the boundary the mailboxes demonstrated: the record
  covers the gate, not the resource — and admits that Windows loses records
  when two processes share a log (measured at 57 of 60 surviving).