Per-lead spec: SES guardrails + signal ownership

SES account is on EnforcementStatus=PROBATION — AWS is already reviewing it, and the next step is SHUTDOWN, which would take down sign-in codes and every other sender in the estate. Added as a hard gate before any ramp; the exact bounce/complaint rates still need a console check (the available IAM user lacks cloudwatch:GetMetricStatistics). Lean on SES-native controls rather than hand-rolled ones: account suppression and VDM are already enabled; add a per-track configuration set for reputation isolation, wire bounce/complaint events to SNS, and verify one-click unsubscribe plus SPF/DKIM/DMARC for the Google/Yahoo bulk sender rules. Signal ownership: leads belongs to newsletter.org, offers to vnoc.growagent.com, partners to ipartner.com. This track reads leads only.