chore(ci): repoint push-email-notify to smtp-notify-action (#53)

Replaces `dawidd6/action-send-mail` with
`hyperpolymath/smtp-notify-action` v0.2.0 (tag commit
`ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7`), per the 2026-09-02 ruling
(standards spec §5.5/§9, PR metadatastician/standards#725). The whole file
is replaced with the `rsr-template-repo` canonical, which — besides the
`uses:` line — restricts the trigger to branch pushes (tag and deletion
payloads mislabel `Branch:`/`head_commit`), sets `timeout-minutes: 5`,
carries a deliberately per-run `concurrency` group, and grants only
`contents: read`. **How many of those are actual changes here depends on
how far this repo's copy had drifted — read the diff, not this list.**
Dormant gating on `vars.PUSH_EMAIL_ENABLED == 'true'` is unchanged. Line
1 SPDX header kept as it was.

Engine: `.git-private-farm/scripts/smtp-notify-sweep.sh`. Verification
for this repo: `regime=lock pristine=invalid post=valid repair
changed=.github/workflows/actions.lock,.github/workflows/push-email-notify.yml,
sig=G 9876757 canon=543fc1474b54 base=main`
(`pristine`/`post` = `gh actions-lock --no-fix` validity before/after;
`repair` = the lock was already invalid before this change and is valid
after it.)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/actions.lock

@@ -3,29 +3,29 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/codeql.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'github/codeql-action@v4.37.9'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
-    '.github/workflows/secret-scanner.yml': []
-    '.github/workflows/codeql.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.37.7'
     '.github/workflows/push-email-notify.yml':
-        - 'dawidd6/action-send-mail@v3.12.0'
+        - 'hyperpolymath/smtp-notify-action@v0.2.0'
+    '.github/workflows/secret-scanner.yml': []
 dependencies:
     'actions/checkout@v7.0.1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
-    'dawidd6/action-send-mail@v3.12.0':
-        ref: 'v3.12.0'
-        commit: 'sha1-0bbdab096651ee93f37ec02383e088183d41ff0b'
-        owner_id: 9713907
-        repo_id: 222439721
-    'github/codeql-action@v4.37.7':
-        ref: 'v4.37.7'
-        commit: 'sha1-ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd'
+    'github/codeql-action@v4.37.9':
+        ref: 'v4.37.9'
+        commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
+    'hyperpolymath/smtp-notify-action@v0.2.0':
+        ref: 'v0.2.0'
+        commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
+        owner_id: 6759885
+        repo_id: 1352485172

.github/workflows/push-email-notify.yml

@@ -4,20 +4,43 @@
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
 # new repos from the template; placed on existing repos by the farm sweep.
+#
+# Re-landed after the 2026-07-20 notification-storm freeze (removed in
+# 09f94c5), now on hyperpolymath/smtp-notify-action: Node-free, the SMTP
+# session is Idris2-specified and machine-checked, the binary is Zig-built,
+# byte-reproducible, and SHA-256-pinned inside the action itself.
 name: Push email notification
 on:
-  push: {}
+  push:
+    # Branch pushes only: tag and deletion payloads mislabel Branch:/head_commit.
+    branches: ['**']
+concurrency:
+  # Deliberately per-RUN, so no run is ever queued behind another and none is
+  # ever cancelled. Do NOT "tidy" this into a shared group such as
+  # ${{ github.workflow }}-${{ github.ref }}. GitHub's workflow-syntax docs:
+  # "By default, any existing pending job or workflow in the same concurrency
+  # group will be canceled and the new queued job or workflow will take its
+  # place." That happens regardless of cancel-in-progress, which governs only
+  # the RUNNING job. On this workflow it silently loses a notification email,
+  # with no error anywhere. Every run here reports a DISTINCT commit, so there
+  # is no redundant work for a concurrency limit to remove.
+  # The docs also offer `queue: max` (up to 100 pending); not used, because 100
+  # is still a cap whereas a per-run group needs none.
+  # Verified with zizmor 1.30.0: deleting this block raises concurrency-limits;
+  # this form silences it exactly as a shared group would.
+  group: push-email-${{ github.run_id }}
+  cancel-in-progress: false
 permissions:
-  actions: read
   contents: read
 jobs:
   notify:
     name: Email on push
     if: ${{ vars.PUSH_EMAIL_ENABLED == 'true' }}
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@v18
+        uses: hyperpolymath/smtp-notify-action@v0.2.0 # NOSONAR — pin authority is actions.lock (sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7)
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}