Wire email domain branding validation into CI/deploy pipeline

[patoperpetua]

Parent: #6
Imported from: singleton-sd/poc-plattform-kit#278

Goal

Automate email-domain branding validation so production (and optionally staging) deploys fail fast when SPF, DKIM, DMARC, BIMI, or BIMI logo/SVG configuration drifts — instead of relying on manual post-deploy runs.

Scope

• Add a GitHub Actions job (or extend the PostKit deploy workflow) that runs the branding validator with deployment-supplied env vars (EMAIL_VALIDATION_*).
• Decide trigger points (e.g. deploy on main after DNS is expected stable, or a scheduled workflow).
• Document required GitHub Variables / Key Vault references — no secrets in workflow YAML.
• Handle DNS propagation gracefully (retry/backoff or clear failure message) without flaky false positives on every merge.

Out of scope

• Changing validator logic itself (ported with packages/post-kit-email; originally poc #266).
• Live mailbox rendering checks (logo display in Gmail/Yahoo) — Human & Operations issues.

Acceptance criteria

• A workflow runs the branding validator against a configured sending domain using repo-documented env configuration.
• Non-zero validator exit fails the workflow with actionable logs.
• docs/email-forward-email.md updated: when CI runs the check vs when operators run it manually.
• No secrets committed; configuration uses OIDC + Key Vault / Variables.

Dependencies

Depends on: library lift including the branding validator files.

Related history on poc: singleton-sd/poc-plattform-kit#266 (merged)

Agent-ready checklist

• Goal/problem statement is clear
• Scope is sufficient to start work
• Acceptance criteria are explicit
• Relevant constraints are stated
• Depends on: email package + validator present on post-kit main