Give a DeepSeek Harness agent its own email inbox

Key features

• Concurrent mail on one thread hits an in-flight latch, so two messages arriving inside the create window produce one session, not two.
• Every inbound body is treated as untrusted input.
• readOnlytrue registers no write tools at all — strictly stronger than any runtime gate.
• throws (cannot get property "x" without inject) rather than returning undefined, and there is no optional-inject form — every declared dependency is awaited.
• Sessions idle past idleDisposeMs are disposed with no eviction ordering to reason about — the log survives, and the API can rebuild regardless.