Redact sent emailOutbox bodies in terra's own drain - enamel's ENAMEL-16 pass is scoped to enamel rows only

coder-enamel-cc ruled ENAMEL-16 Phase A per-app: enamel redacts subject/bodyText/bodyHtml only on its OWN emailOutbox rows (appKey=enamel AND sendStatus='sent' AND subject IS NOT NULL) and never writes another tenant's row (tag coder-enamel-cc-muu8o20zgia8). So terra's sent rows keep their bodies indefinitely unless terra's drain redacts them. Today: 1 sent terra row. The 4 failed 10-01 rows (TERRA-260) stay unredacted by the same predicate, pending a resend decision. Scope: apply the same predicate (appKey='terra') in terra's drain, outside the send transaction, keep messageId/attempts/claimToken/sentAt/status. Design follows ENAMEL-16 Phase A after its audit-general-ca design PASS; Class-A (email path), so an audit design-ping goes first. Not started: waits on ENAMEL-16 Phase A landing so the two apps share one predicate.