RustBox 0.2.6 - final source validation

0.2.6 scope:
- iOS-safe reader action popovers for Details and Move / copy, portaled outside the horizontally scrolling toolbar
- faster folder-counter refresh using a server-authoritative realtime unread counts and a longer folder-list cache TTL
- live refresh for the currently viewed folder via IMAP IDLE plus a 30-second fallback sync for other folders
- periodic sync stores newly arrived message headers before emitting realtime events, so new messages can appear in the list immediately
- in-app toast for new mail in any folder and per-message browser-notification deduplication
- animated indexing indicator beside Contacts while deep indexing is active
- deep indexing excludes Trash/Junk/Spam at query time so excluded folders cannot block the indexing queue
- manual refresh forces current-folder status refresh while folder-list/count refresh runs in parallel
- no database migration; V047 remains current and V048 remains next
- version metadata updated to 0.2.6

Completed in this environment:
- offline release validator: scripts/validate-release-static.py (212/212 checks passed)
- all maintained TOML examples parse successfully
- Docker Compose topology/config references are validated by the offline release validator
- JSON files parse successfully
- browser JavaScript assembled in src/web/js/manifest.txt order passes node --check
- shell scripts pass bash -n
- Python helper scripts compile successfully
- targeted source checks validate the PostgreSQL header-sync UPSERT and startup schema-initialization control flow
- the PostgreSQL startup DDL path now uses `Executor::execute()` instead of the lifetime-problematic `raw_sql(...).execute(&mut PgConnection)` path; compiler validation remains part of the Rust-host release gate
- whitespace/patch-artifact checks pass on the final source tree (this packaged worktree has no `.git` metadata)
- Cargo.lock is retained for reproducible builds; no *.orig, *.rej, temporary FIX/APPLY scripts, or patch leftovers are shipped
- regression source checks retain the PostgreSQL header-sync qualification audit and now reject the SQLx raw_sql mutable-connection lifetime regression in startup DDL
- SQLite unit-test configuration no longer leaks a temporary database path through the process-wide OnceLock; a dedicated regression test covers deleted TempDir reuse
- the static release contract now verifies that build-release.sh requires cargo test, Clippy with -D warnings, and a locked release build
- scripts/package-release.sh runs the full build gate before creating the source ZIP and SHA256, so packaging cannot succeed after a failed Rust test/Clippy/build gate

0.2.2 fixes included:
- PostgreSQL startup schema initialization no longer triggers SQLx `Executor is not general enough`; raw multi-statement DDL is executed directly through `Executor::execute()` inside the existing transaction
- PostgreSQL header-sync invalidation qualifies the existing tenant user_meta.value in ON CONFLICT DO UPDATE, eliminating the ambiguous-column 500 seen during message mutations such as marking spam
- tenant SQL rewriting has a regression test proving the qualified user_meta reference is rewritten to the tenant table
- SQLite and MySQL equivalents were reviewed and do not have the PostgreSQL ambiguity
- 0.2.2 single-schema-owner and PostgreSQL NOTICE-noise fixes remain in place
- no database migration is required; V047 remains current and V048 remains next
- 0.2.1 OpenPGP visibility, OpenSearch backpressure and HTTP/dev cookie fixes remain in place

Not executed in this packaging environment:
- cargo fmt/test/clippy/build with Rust 1.99.1, because Rust/Cargo is not installed in this validation environment
- live PostgreSQL/MySQL/S3/NFS/OpenSearch integration tests

The final release gate on a Rust host is:
  bash scripts/build-release.sh

This file intentionally does not claim blocked runtime/integration checks as passed.