feat(iios): email adapter dedup fix + smoke + verification

Adds adapter-owned externalEventId extraction to the ChannelAdapter contract
(WebhookAdapter→eventId, EmailAdapter→Message-ID) and uses it in InboundService,
so email replays dedup on Message-ID (previously only payload.eventId worked).
Adds an email-dedup spec + smoke-email.mjs proving inbound → normalized, a reply
joins the same email thread, bad signature rejected, and outbound EMAIL SENT.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-adapter-sdk/src/webhook-adapter.ts

@@ -37,6 +37,11 @@ export class WebhookAdapter implements ChannelAdapter {
     return hmacVerify(rawBody, secret, typeof sig === 'string' ? sig : undefined);
   }
 
+  externalEventId(payload: unknown): string | undefined {
+    const id = (payload as WebhookPayload)?.eventId;
+    return typeof id === 'string' ? id : undefined;
+  }
+
   normalize(payload: unknown, ctx: NormalizeContext): IngestInteractionRequest {
     const p = payload as WebhookPayload;
     return {