Merge commit from fork
The inline email normalizer validated the address on the ASCII `@` before any
Unicode normalization. A character that is a homoglyph of `@` — e.g. U+FF20
FULLWIDTH COMMERCIAL AT — passed the single-`@` (atCount) check, but can be
canonicalized to an ASCII `@` by a downstream address parser (NFKC), splitting
the address into multiple recipients (CWE-180: validate before canonicalize).
Apply `String.prototype.normalize("NFKC")` before validation so any such
homoglyph becomes a real `@` and is rejected by the existing atCount check.
Behaviour on legitimate addresses is unchanged. Adds a regression test.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
