Say when a channel cannot be checked, instead of skipping it

The estate's SendGrid key is send-only: mail.send and the batch scopes,
with no suppression.read, no bounces.read, no stats. So email delivery
cannot be reconciled the way SMS now is.

The tempting move is to check SMS and quietly say nothing about email.
That is precisely how a gap disappears - the daily report looks clean
and the unchecked channel stops being a question anyone asks. It now
reports 'email delivery NOT VERIFIED' with the exact scope that would
fix it, every day, until somebody does.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

tests/test_reconcile.py

@@ -99,3 +99,40 @@ def test_a_refused_ledger_query_is_loud():
 
 def test_window_start_looks_backwards():
     assert window_start(24) < datetime.now(timezone.utc)
+
+
+# --------------------------------------------------------------- email
+
+from app.reconcile import EmailReport, describe_email, email_bounces  # noqa: E402
+
+
+def test_a_key_that_cannot_read_bounces_says_so_instead_of_reporting_clean():
+    """The estate's key is send-only. Skipping the check quietly is how a
+    channel nobody can see becomes a channel nobody checks."""
+    def forbidden(url, *, headers, timeout):
+        return Response(status=403, body='{"errors":[{"message":"access forbidden"}]}', headers={})
+
+    report = email_bounces(api_key="SG.x", since=window_start(24), get=forbidden)
+
+    assert report.checked is False
+    assert report.bounces == []
+    assert "suppression.read" in report.reason
+    assert "NOT VERIFIED" in describe_email(report)
+
+
+def test_bounces_are_reported_without_publishing_addresses():
+    def ledger_of_bounces(url, *, headers, timeout):
+        return Response(status=200, headers={}, body=json.dumps([
+            {"email": "[email protected]", "reason": "550 5.1.1 user unknown"}]))
+
+    report = email_bounces(api_key="SG.x", since=window_start(24), get=ledger_of_bounces)
+    text = describe_email(report)
+
+    assert report.checked and len(report.bounces) == 1
+    assert "***@example.test" in text
+    assert "[email protected]" not in text
+
+
+def test_no_key_is_reported_as_unverified_not_as_healthy():
+    report = email_bounces(api_key="", since=window_start(24))
+    assert report.checked is False and "no SendGrid key" in report.reason