mailsec: make the command surface discoverable

[maximelb]

What

limacharlie help discover (the only consumer of discovery.PROFILES) is how an operator — or an agent driving the CLI — finds out a command exists at all. None of the ~27 mailsec verbs appeared in any profile, so the entire Email Security surface was invisible to it. Pre-existing gap, flagged while reviewing #352.

• New email_security profile enumerating all 27 current mailsec verbs, enumerated by walking the live click group rather than by hand.
• Response-relevant verbs cross-listed into threat_response (message list|get|action|bulk-action, campaign action, hunt create|remediate) — the same convention the case verbs already follow.
• TestMailsecCoverage pins it in both directions: a verb the profiles do not list, and a profile entry that no longer resolves to a real command. Modelled on the existing test_cli_command_map_lint.py lint over _COMMAND_MODULE_MAP.
• test_all_profiles_exist now lists cases and email_security; its hand-maintained expectation had drifted (cases was already missing).

Schema left exactly as-is ({description, commands: [str]}), matching how cases — the closest precedent, one noun, full verb enumeration — is represented.

Verification

Pin verified by mechanism, not just outcome: renaming one entry to bulk-statuz made both tests fail with the intended messages; restoring made them pass.

Full CI suite (tests/unit/ tests/microbenchmarks/), Python 3.13: 4085 passed, 5 skipped (the 5 skips are pre-existing: 2 platform-gated, 2 pre-existing-docstring, 1 Windows-only).

Pre-existing gaps found, deliberately NOT fixed here

Kept narrow to mailsec. Each of these is a separate change:

1. 32 of 58 top-level commands are absent from PROFILES entirely — including cloudsec and hive, so there was no comparable surface to mirror. Full list: ai-cost-model, ai-memory, ai-skill, app, arl, artifact, auth, cloud-adapter, cloudsec, completion, config, exfil, extension, external-adapter, feedback, help, hive, ingestion-key, integrity, job, logging, lookup, note, payload, playbook, schema, secret, sop, spotcheck, usp, vulnerability (+ mailsec, fixed here).

2. 20 existing profile entries point at commands that do not exist: the 10 rule * entries, fp create, org config get|set, search interactive, search saved * (4), sensor online, sync diff. This is why the new lint is scoped to mailsec — a repo-wide version fails on day one.

   → Now fixed in discovery: repair the 20 rotted PROFILES entries and lint them #355, stacked on this branch. (That PR re-derived the replacements from the live command tree and corrected this list: there are 10 rule * entries, not 11, and they map to dr *, not dr rule *.)

3. Doc drift: doc/cli/README.md, doc/cli/other-commands.md and doc/getting-started.md document limacharlie discover and limacharlie cheatsheet as top-level commands (they are limacharlie help discover / limacharlie help cheatsheet), and reference a --profile incident_response that does not exist (the profile is threat_response).

🤖 Generated with Claude Code