Add bounded outreach cadence

[yubnsbski]

What changed

• add a persisted outreach cadence with active, replied, opted_out, and exhausted states
• schedule at most two follow-ups at fixed offsets from the initial message
• suppress every future follow-up immediately after a reply or opt-out
• enforce a deterministic daily follow-up cap and idempotent message references
• keep cadence decisions separate from SQLite persistence and from message delivery
• add wbz outreach add|list|due|sent|reply|opt-out
• expose outreach state in CLI and localhost audit snapshots
• keep outreach disabled by default and document the threat boundary

Why

Periodic follow-up should be reviewable and bounded, not an unconditional resend loop. WBZ now owns the schedule, stopping rules, and audit evidence while leaving delivery to a separately reviewed adapter.

Safety boundary

This PR does not send email. A sender must first request the due list and then record a successful delivery with an opaque message reference. Failed sends do not advance the cadence. Email bodies are not persisted or written to audit events.

Maintainability

• outreach.py contains policy and state-transition decisions
• outreach_store.py contains SQLite details only
• timestamps are timezone-aware and normalized to UTC
• fixed clocks in tests cover restart, duplicate delivery records, early sends, replies, opt-outs, zero-follow-up policy, and daily caps
• the audit API contract is covered without coupling the dashboard renderer to delivery

Validation

• python -m pytest -q: 30 tests passed
• python -m compileall -q src tests
• wbz outreach --help
• git diff --check