mailsec: require the campaign preview token in CLI guidance

[maximelb]

Summary

• correct the SDK and CLI contract: campaign execution needs the member-bound token returned by preview, not the campaign id
• update examples and option help so an operator can complete the guarded preview/confirm flow
• add regressions for the SDK wire value, rendered CLI guidance, and unchanged CLI token/action/reason forwarding

Safety

This does not weaken the server-side member-set binding or perform any live campaign mutation. The token is still forwarded unchanged and the collector re-derives it against current membership.

Verification

• python3 -m pytest -o addopts='' -q tests/unit/test_sdk_mailsec.py tests/unit/test_cli_mailsec.py (36 passed)
• complete local unit/microbenchmark suite in an isolated dev install (3,985 passed, 5 skipped)
• local sdist and wheel build succeeded