Merge commit from fork
`defaultNormalizer` validated the email on the ASCII `@` before any Unicode
normalization. A character that is a homoglyph of `@` — e.g. U+FF20 FULLWIDTH
COMMERCIAL AT — passed the single-`@` check, but can be canonicalized to an
ASCII `@` by a downstream address parser (NFKC), splitting the address into
multiple recipients (CWE-180: validate before canonicalize).
Apply `String.prototype.normalize("NFKC")` before validation so any such
homoglyph becomes a real `@` and is rejected by the existing checks. Behaviour
on legitimate addresses is unchanged. Adds regression tests covering U+FF20 and
U+FE6B.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
