mail watch --exec passes unverified bodies to hooks #375

Follow-up from the envelope-verification-on-promotion work (Refs ops-8mhg).

tps mail watch --exec hands a message body to the hook before the signed envelope is
checked. Every other consumer now routes new/ → cur/ through the shared promote()
enforcement point, which verifies before anything is presented; mail watch --exec does
not, so a hook can be driven by a body that was never verified.

Make mail watch --exec call promote() and pass only verified bodies to hooks. This is
the highest-priority of the remaining consumers: its lane is being reused for further
work, so leaving it unverified would widen the same gap rather than close it.

Refs ops-8mhg