Add email ownership security boundaries

[nonggde]

Closes #437

Summary

• add folder-local Email Ownership Tracker guard helpers for ownership events, ids, actions, emails, team members, tags, attachment metadata, and bounded histories
• add hostile input fixtures covering path-like ids, unsafe message ids, unsupported actions, email header injection, missing owners, bad timestamps, unsafe tags, bad attachment sizes, and text cleanup
• document threat assumptions, unsafe inputs, performance budgets, and future integration requirements

Scope

• only touches tools/v1/team/email-ownership-tracker/
• no app shell, dashboard, routing, inbox architecture, compose/send flow, auth, wallet, Stellar, database, mail rendering, notification, provider, analytics, or design-system integration
• no production data, live network calls, server persistence, secrets, webhooks, background jobs, mailbox mutation, ownership writes, or attachment body inspection
• avoids the old closed [V1][team] Email Ownership Tracker - Security and performance hardening #437 attempt paths such as services/ownership.service.ts and services/ownership-guards.mjs

Validation

• node --test tools/v1/team/email-ownership-tracker/tests/ownership-boundaries.test.mjs
• npx --yes prettier --check tools/v1/team/email-ownership-tracker/guards/ownership-boundaries.mjs tools/v1/team/email-ownership-tracker/fixtures/hostile-ownership-inputs.json tools/v1/team/email-ownership-tracker/docs/SAFETY_LIMITS.md tools/v1/team/email-ownership-tracker/tests/ownership-boundaries.test.mjs
• git diff --cached --check
• ASCII scan over changed Email Ownership Tracker files

Notes

• the current upstream tool folder only has placeholder README/specs, so this PR adds a self-contained safety layer without changing existing runtime code
• future integration should call these guards before any inbox read, ownership write, notification fanout, background job, or analytics update