RustBox validation

Release source checks:

one root Cargo package (Cargo.toml at repository root);
no backend/ application directory;
no separate frontend/ directory;
no .ts or .tsx source files;
no Node/Bun/Next/React build dependency;
UI files live under src/web/ and are embedded into the Rust executable;
mail endpoints are configuration-owned; the login request contains only email/password/session preference;
authenticated mail routes reuse the resolved session connection profile;
CSS is built by Cargo build.rs from src/web/css/manifest.txt;
no CSS gradients and no Unicode pseudo-icons in the browser UI;
all UI action icons are served from the embedded SVG sprite;
dev.sh runs the root Cargo package;
native release build outputs target/release/rustbox;
UPSTREAM_BASE records the consumed Oxi backend revision;
upstream tooling maps Oxi backend/ deltas into RustBox's flat paths and never imports Oxi frontend source.

Full release gate on a host with Rust/Cargo and dependency access:

cargo fmt --all -- --check
cargo test --locked
cargo clippy --locked --all-targets -- -D warnings
./scripts/build-release.sh