Integration harness

Build server:
  dotnet build server/IOC.Server.csproj -c Release

Run on Windows with extracted official ClamAV binaries:
  dotnet run --project tests/IOC.Tests.csproj -c Release -- <absolute test-work>
    <absolute dotnet.exe> <absolute server/bin/Release/net10.0-windows/IOC.Mail.Server.dll>
    <absolute ClamAV directory>

All four arguments are required, on one command line.
Ports: 18443,18444,18025,18587,18465,18143,18993,18110,18995,18331 (loopback).
Do not run two harnesses simultaneously on these ports.
The harness creates a fresh data subdirectory and random test password.
No real-domain delivery or messages to third parties are performed.
Trust is pinned to the generated test certificate in client callbacks.
The release server has no certificate-validation bypass for outbound delivery.

ClamAV test uses IOC_MAIL_HARMLESS_SCANNER_TEST_42 as a harmless custom signature.
This verifies that the real ClamAV executable accepts streams and detects
the configured signature. It is not an independent malware-detection benchmark.
FreshClam official daily/main/bytecode downloads were separately exercised.

The test report is TEST-RESULTS.json. Browser tests and release verification
results are documented in RELEASE-VERIFICATION.txt.

Not covered: all target Windows versions, SCM/UAC installation in a clean VM,
uninstall preservation, reboot, Authenticode, actual Internet deliverability,
concurrency/load/fuzzing, security audit, RFC-complete IMAP behavior.
