test(qawemail): 去掉单测对外部 DNS 的依赖

为什么：normalize 会解析主机名，测试用 smtp.example.com；构建机没有外网 DNS 时
必红（run164 tests-go 3 个失败）。改成 localhost，并补一条 .invalid 保留域必须
判非法的断言，校验规则没有放宽。

CHANGELOG.md

@@ -19,6 +19,11 @@
 - `GET /library/overview` 的差异结果新增 `wiki`：两份快照 `wiki_pages` 的新增/更新/撤销页数与样例，
   明确标注页面级、不代表实体/边/引用重算；缺部件时如实 unknown。
 
+### Fixed
+
+- `internal/qawemail` 单测把 `smtp.example.com` 当成可解析主机，构建机没有外网 DNS 时必红；
+  改用 `localhost` 并新增"RFC 6761 保留域 .invalid 必须判非法"的确定性断言（不放宽校验）。
+
 ### Changed
 
 - 启动同步的缺项包含"没有与目标快照匹配的有效发布授权"与容量预算；作业只有在编排返回成功时才标成功。

internal/qawemail/store_test.go

@@ -39,14 +39,20 @@ func TestNormalizeRefusesEnabledSettingsWithoutTransportAndBadRecipients(t *test
 	if _, err := normalize(SettingsInput{Host: "", From: "", Recipients: nil, Enabled: true}); err != ErrInvalid {
 		t.Fatalf("enabled without host/from/recipients must be invalid, got %v", err)
 	}
-	if _, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"not-an-address"}, Enabled: true}); err == nil {
+	if _, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"not-an-address"}, Enabled: true}); err == nil {
 		t.Fatal("a malformed recipient must be rejected")
 	}
-	good, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com", "b@example.com"}, Enabled: true})
+	// 校验会解析主机名；用 localhost 避免把构建机的 DNS 当成被测行为。
+	good, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com", "b@example.com"}, Enabled: true})
 	if err != nil || good.Port != 465 || good.Weekday != 1 || len(good.Recipients) != 2 {
 		t.Fatalf("defaults not applied: %+v %v", good, err)
 	}
-	duplicated := SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com", "A@example.com"}}
+	// 解析不了的主机名必须仍被判为非法：.invalid 是 RFC 6761 保留域，永远不解析。
+	if _, err := normalize(SettingsInput{Host: "smtp.kg-test.invalid", From: "kb@example.com",
+		Recipients: []string{"a@example.com"}}); err != ErrInvalid {
+		t.Fatalf("unresolvable host must stay invalid, got %v", err)
+	}
+	duplicated := SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com", "A@example.com"}}
 	if _, err := normalize(duplicated); err != ErrInvalid {
 		t.Fatal("case-insensitive duplicate recipients must be rejected")
 	}
@@ -94,11 +100,11 @@ func TestMailerRefusesPlaintextServersWithoutSTARTTLS(t *testing.T) {
 }
 
 func TestNormalizeRejectsACopyThatIsAlsoAPrimaryRecipient(t *testing.T) {
-	_, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com"}, Cc: []string{"A@example.com"}, Enabled: true})
+	_, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com"}, Cc: []string{"A@example.com"}, Enabled: true})
 	if err != ErrInvalid {
 		t.Fatal("a person in both To and Cc would receive the report twice")
 	}
-	good, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com"}, Cc: []string{"b@example.com", "c@example.com"}, Enabled: true})
+	good, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com"}, Cc: []string{"b@example.com", "c@example.com"}, Enabled: true})
 	if err != nil || len(good.Cc) != 2 {
 		t.Fatalf("valid cc list rejected: %+v %v", good.Cc, err)
 	}
@@ -121,11 +127,11 @@ func TestBuildMIMEPlacesTheChartAfterTheBodyAsAnInlineImage(t *testing.T) {
 }
 
 func TestNormalizeAcceptsAnOptionalReviewAddressAndRejectsMalformedOnes(t *testing.T) {
-	good, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com"}, Review: "owner@example.com", Enabled: true})
+	good, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com"}, Review: "owner@example.com", Enabled: true})
 	if err != nil || good.Review != "owner@example.com" {
 		t.Fatalf("review address rejected: %q %v", good.Review, err)
 	}
-	if _, err := normalize(SettingsInput{Host: "smtp.example.com", From: "kb@example.com", Recipients: []string{"a@example.com"}, Review: "not-an-address"}); err != ErrInvalid {
+	if _, err := normalize(SettingsInput{Host: "localhost", From: "kb@example.com", Recipients: []string{"a@example.com"}, Review: "not-an-address"}); err != ErrInvalid {
 		t.Fatal("a malformed review address must be rejected")
 	}
 }