Add outbound sender identity verification for maildesk-cf

[rogu3bear]

Context

maildesk-cf commit 229b04f adds public runbooks for outbound identity and deliverability:

• docs/architecture/outbound-identity.md
• docs/operations/deliverability.md
• docs/operations/production-rollout.md

Inbound Email Routing can now be reconciled through email.routing_rule, but mail-ready status still needs outbound sender identity proof. Forwarding to an operator mailbox is not enough to claim replies will come from the original domain.

Needed Change

Add cfctl read/verify support for sender-domain and reply-identity readiness used by maildesk-cf. The surface should be usable by the future cfctl maildesk-cf verify flow and should avoid broad live-send tests by default.

Drift Classes

• missing sender-domain authentication
• unverified DKIM/SPF/DMARC posture
• reply identity configured in policy but not verified for outbound send
• provider status unavailable or ambiguous
• sender adapter configured for a domain that is receive-only

Acceptance Criteria

• Verification can report sender readiness per domain and per reply identity.
• Output is machine-readable and safe to cite in template/private receipts.
• It distinguishes Cloudflare Email Service support from optional provider adapters such as Resend.
• It does not expose secret values.
• It does not send live mail unless explicitly requested.

References

• rogu3bear/maildesk-cf@229b04f:docs/architecture/outbound-identity.md
• rogu3bear/maildesk-cf@229b04f:docs/operations/deliverability.md
• cfctl Add first-class maildesk-cf provisioning surface #13
• cfctl Align cfctl verification with maildesk-cf preflight and drift states #14

[rogu3bear]

New live evidence from star-maildesk-cf after the Email Worker accepted and audited a routed message:

• Resend probe to founders@theauchshop.com delivered to Cloudflare after the router stopped rejecting on per-recipient forward errors.
• D1 audit recorded routeKind=role_alias and defaultReplyIdentity=founders@theauchshop.com.
• forwardErrors for both james@mlnavigator.com and donella@mlnavigator.com were cannot forward email to same worker.
• Both destination addresses are verified Cloudflare destination addresses, but using the same address as both a custom route and destination is still a loop. Converting james@mlnavigator.com and donella@mlnavigator.com rules to direct forward actions did not solve it, because the destination equals the routed address.

Implication: cfctl needs first-class destination-address/readiness modeling, not just rule shape. It should catch “operator mailbox is also routed through the same worker / same address loop” before maildesk-cf is called mail-ready. It should also support forward-action rules without requiring --service as a fake selector.

[rogu3bear]

Correction/update after the latest private probe and template change:

• The earlier direct-forward note was stale. After converting the james@mlnavigator.com and donella@mlnavigator.com routes away from the same Email Worker path, the later founders@theauchshop.com probe audited cleanly with forwardErrors: [] and both operators in forwardedTo.
• maildesk-cf commit 29a28f4 adds the public outbound reply adapter contract: token-gated /api/replies, policy-based operator/reply identity authorization, disabled / cloudflare_email_service / resend sender modes, verified sender-domain allowlist, and audit events for authorization, attempted send, and provider result.
• The cfctl gap is now sharper: verification should report inbound route loops separately from outbound sender readiness, and it should be able to read Cloudflare Email Service availability distinctly from third-party sender verification.

This issue should remain the tracking point for sender-domain/reply-identity readiness. The first-class provisioner issue (#13) can consume its result when deciding whether an instance is edge-ready vs mail-ready.