mailsec: return exact bytes from justified EML downloads

[maximelb]

Summary

• decode the public mailsec EML route's base64 JSON envelope in the SDK
• refuse malformed base64 and declared-size mismatches instead of returning corrupt evidence
• write exact RFC822 bytes to the CLI output file or binary stdout
• cover the audited justification, response validation, file output, and stdout contracts

P0 relevance

Section 12.2 requires a public justified EML download. The service returns {eml_b64,size,...}; before this change the SDK returned that dictionary and message eml --out-file wrote its Python representation, not the original message.

This PR performs no provider mutation and no deployment.

Validation

• python3 -m pytest -q -o addopts='' tests/unit/test_sdk_mailsec.py tests/unit/test_cli_mailsec_eml.py (31 passed)
• python3 -m pytest -q -o addopts='' tests/unit (3874 passed, 19 skipped)
• python3 -m compileall -q limacharlie
• git diff --check