Fix maildesk account evidence lane

[rogu3bear]

Summary

• Make maildesk-cf live account-resource evidence use the explicit global lane for Workers, D1, R2, and Queues, matching existing domain and sender readbacks.
• Prevent false missing_resource drift when the default dev lane cannot see resources that already exist in the account.
• Add a maildesk contract assertion so future lifecycle changes preserve the evidence lane boundary.

Test plan

• ./scripts/verify_maildesk_cf_contract.sh
• ./scripts/verify_static_contract.sh
• Live private maildesk plan readback: edge_ready=true, only sender-domain drift remains

Risk and review notes

• Behavioral change is limited to live evidence collection for the composite maildesk-cf lifecycle.
• The wider lane is read-only inventory in this path; component mutations still remain preview/ack gated.
• Recent GitHub Actions runs on this repo are failing at the workflow level because of the account billing lock, so local contract proof is the actionable proof lane for this PR.

@codex Please review whether pinning these account-resource reads to the global lane is the right long-term policy, or whether cfctl should instead expose a separate maildesk evidence lane abstraction for account-level inventory.

[rogu3bear]

Local proof for the billing-locked CI run:\n\n- ./scripts/verify_maildesk_cf_contract.sh passed\n- ./scripts/verify_static_contract.sh passed\n- Live private maildesk plan readback after this branch: edge_ready=true; remaining drift is sender-domain-only, blocked by Cloudflare Email Sending API 2036 Unauthorized\n\nThe remote static contract job did not start because GitHub reports the account is locked due to a billing issue.