feat(email): opt in to preserving inbound HTML formatting

[Wenfengcheng]

Problem

Fixes #23695.

Incoming email formatting can carry meaning (red/green review decisions, headings, font sizes). The email adapter always prefers text/plain and strips tags from HTML-only messages, so the agent cannot see that information even when an operator wants it.

Root cause

EmailAdapter._parse_fetched_message unconditionally calls _extract_text_body in plaintext mode. There is no inbound HTML preference in the adapter config. Existing outbound HTML PRs (#25441, #93294) address a different direction; #68707 addresses entity decoding, not choosing the HTML MIME alternative.

Change

• Add opt-in platforms.email.preserve_html: true, default false, through the existing PlatformConfig.extra path and boolean parser.
• Reuse _first_body_part and _safe_decode to prefer non-empty, non-attachment HTML, retaining plaintext fallback and default behavior.
• Pass decoded HTML as message text; no rendering, external-resource fetching, new dependency, tool, or env var.
• Document the untrusted-content tradeoff and configuration.

Verification

Base: dad9c567482c5f365e4922d9348622378de91759.

Native Windows, isolated HOME/USERPROFILE/HERMES_HOME/APPDATA/LOCALAPPDATA, existing Python 3.11 test interpreter; no live mailbox or credentials.

bash scripts/run_tests.sh tests/gateway/test_email_preserve_html.py -j 2 --file-retries 0

• Base RED: 7 assertion failures, 24 passed (formatting lost both during parsing and in the dispatched event).
• Focused GREEN: 31 passed.
• Matrix covers default/false/string-false/true/string-true; single and multipart HTML, attachment exclusion, empty bodies, plain fallback, unknown charset fallback.
• Real YAML loader → adapter → MIME parse → dispatched MessageEvent checked with true/false/true settings.
• git diff --check passed.

Post-publication continuation on the same PR:

• Expanded MIME boundaries to skip entire attached-message subtrees and recognize mixed-case attachment disposition; reproduced 4 assertion failures before the follow-up fix.
• Preserved plain-text fallback for whitespace-only HTML; reproduced 2 assertion failures before the follow-up fix.
• Final focused matrix: 51 passed.
• Broader email suite: 120 passed across 6 files, including charset fallback, robustness, secret scope, and IMAP ID regressions.
• Blank HTML candidates are skipped so a later nonblank HTML alternative is still selected (additional 2 assertion failures reproduced before fixing).
• No live IMAP/SMTP service was contacted; YAML loading, MIME decoding, adapter construction and event dispatch use real production code with local fixtures.

Exact-head review at 80902e85e6d3be3c4036f571b9462b717d630563: Codex STATIC PASS. Claude Code 2.1.280 / Opus 5.5 returned repeated HTTP 503 and hit the bounded timeout; its review remains pending, not PASS.

Scope / remaining

All requested inbound preserve_html behavior is implemented. Outbound rich email, HTML sanitization/rendering, charset redesign, and sender authorization are unchanged. No live IMAP/SMTP validation is claimed.