Prevent DMARC domain mismatch in From rules

Found in the security review of Task 9586 (from-rule exact matching). Ask: `ses_inbound.py` parses the From header with `email.policy.default`, which reads headers such as `boss@victim.com <a@evil.example>` or `boss@victim.com (x) <a@evil.example>` as `boss@victim.com`. A DMARC evaluator that reads the angle-addr would align `evil.example` instead, so a From that passed DMARC for the attacker's domain could satisfy an exact `boss@victim.com` rule in `trigger_intake.from_rule_matches`. Verify how SES and tenant Gmail evaluate such headers; if they can disagree, make `trigger_intake.email_matches` also require the parsed From domain to equal (or be a subdomain of) `verdicts["sender_domain"]` (the DMARC-aligned domain recorded at `ses_inbound.py` ~:495) before a `from` rule counts. Out of scope: To/Subject rules; DMARC rejection policy; the multi-mailbox From case (fixed in Task 9586). Done means: - A test proving a From whose display name looks like an address but whose angle-addr is another domain does not fire a `from` rule for the display-name address. - `./dc check quick` green; PR merged to develop. Required checks: ./dc check quick

A From rule now fires only when the parsed From aligns with the DMARC-proven domain. Ambiguous Froms fail closed (display-name address, `From :`, comment in domain). Quick gate green, 203 tests pass. PR #6811 queued. Memory: proposed 1 gotcha.