feat(emailgen): global persona pool + Date-stamped EML mtimes

Two changes that unwind earlier MazeNET-only assumptions and fix a
realism tell:

1. Persona resolution is now per-decky-source, not topology-only.  The
   scheduler walks the union view (list_running_deckies, including
   fleet MACVLAN/IPVLAN + SWARM shards) and picks the right persona
   list for each source:
     * topology decky -> Topology.email_personas (per-topology richness
       preserved)
     * fleet / shard  -> a single host-wide pool loaded from disk
       (DECNET_EMAILGEN_PERSONAS, /etc/decnet/email_personas.json, or
       ~/.decnet/email_personas.json)
   Operators install the global pool via 'decnet emailgen
   import-personas <file>' which validates with the same Pydantic
   schema the worker uses.

2. The driver now runs 'touch -d <Date>' inside the docker exec right
   after the EML write so file mtime matches the email's RFC 2822
   Date: header.  Without this an attacker 'ls -lt'ing the spool sees
   every email clustered inside the worker's tick window — the
   cluster itself was a stylometric tell.

CLI now exposes 'decnet emailgen' as a sub-app with 'run' (default,
backwards-compatible with bare 'decnet emailgen') and 'import-personas'.
list_running_deckies carries topology_id through so consumers can resolve
the parent topology without a second round-trip.

tests/orchestrator/emailgen/test_global_pool.py

@@ -0,0 +1,99 @@
+"""Global persona pool — disk-backed source for fleet/shard mail deckies."""
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from decnet.orchestrator.emailgen import global_pool
+
+
+@pytest.fixture(autouse=True)
+def _reset():
+    global_pool.reset_cache()
+    yield
+    global_pool.reset_cache()
+
+
+_TWO = [
+    {
+        "name": "John Smith",
+        "email": "john@corp.com",
+        "role": "COO",
+        "tone": "formal",
+        "mannerisms": ["uses 'Best regards'"],
+    },
+    {
+        "name": "Sarah Johnson",
+        "email": "sarah@corp.com",
+        "role": "PM",
+        "tone": "direct",
+        "mannerisms": ["uses bullets"],
+    },
+]
+
+
+def test_load_returns_empty_when_file_missing(tmp_path, monkeypatch):
+    monkeypatch.setenv(
+        "DECNET_EMAILGEN_PERSONAS", str(tmp_path / "does-not-exist.json")
+    )
+    assert global_pool.load() == []
+
+
+def test_load_returns_parsed_personas(tmp_path, monkeypatch):
+    f = tmp_path / "personas.json"
+    f.write_text(json.dumps(_TWO))
+    monkeypatch.setenv("DECNET_EMAILGEN_PERSONAS", str(f))
+    personas = global_pool.load()
+    assert len(personas) == 2
+    assert {p.email for p in personas} == {"john@corp.com", "sarah@corp.com"}
+
+
+def test_load_resolves_language_default(tmp_path, monkeypatch):
+    f = tmp_path / "personas.json"
+    f.write_text(json.dumps(_TWO))
+    monkeypatch.setenv("DECNET_EMAILGEN_PERSONAS", str(f))
+    personas = global_pool.load(language_default="es")
+    assert all(p.language == "es" for p in personas)
+
+
+def test_load_invalid_json_returns_empty(tmp_path, monkeypatch):
+    f = tmp_path / "personas.json"
+    f.write_text("{not valid")
+    monkeypatch.setenv("DECNET_EMAILGEN_PERSONAS", str(f))
+    assert global_pool.load() == []
+
+
+def test_load_caches_until_mtime_changes(tmp_path, monkeypatch):
+    f = tmp_path / "personas.json"
+    f.write_text(json.dumps(_TWO))
+    monkeypatch.setenv("DECNET_EMAILGEN_PERSONAS", str(f))
+
+    first = global_pool.load()
+    assert len(first) == 2
+
+    # Re-write with a single persona; bump mtime so the cache invalidates.
+    import time as _time
+    _time.sleep(0.01)
+    f.write_text(json.dumps(_TWO[:1]))
+    import os
+    os.utime(f, None)
+
+    second = global_pool.load()
+    assert len(second) == 1
+
+
+def test_resolve_path_honours_env_override(tmp_path, monkeypatch):
+    monkeypatch.setenv("DECNET_EMAILGEN_PERSONAS", str(tmp_path / "x.json"))
+    assert global_pool.resolve_path() == tmp_path / "x.json"
+
+
+def test_resolve_path_falls_back_to_user_path_when_system_missing(monkeypatch):
+    monkeypatch.delenv("DECNET_EMAILGEN_PERSONAS", raising=False)
+    # In a typical dev box /etc/decnet/ doesn't exist; the resolver
+    # should pick ~/.decnet/email_personas.json.
+    p = global_pool.resolve_path()
+    # We don't assert the exact path (depends on whether /etc/decnet
+    # exists on the test host), only that it ends with the canonical
+    # filename and isn't an empty path.
+    assert p.name == "email_personas.json"