campaigns: MAIN_EXCLUDE_OPERATORS override + Gmail-only exclusion for post-DKIM re-send

After the Jun 2026 no-DKIM incident (campaign mail went out unsigned ->
junked/blocked, ~23% delivery), DKIM is fixed and we must re-send to the
now-signed audience. The builder previously held Google AND Microsoft AND
consumer-MX out until warmup day 30; that blocks the re-send of the Microsoft-
hosted business domains that are most of the list.

Add MAIN_EXCLUDE_OPERATORS (comma-separated mx_provider labels) to override
WARMUP_EXCLUDE_OPERATORS. Set it to 'google' in the workers env so we send to
everything EXCEPT Google's consumer inboxes (still recovering reputation),
including Microsoft/Hotmail. Drives both the SQL exclude and the per-operator
daily cap consistently. Unset => prior default; '' => exclude nobody.

docker-compose.yml

@@ -125,6 +125,14 @@ services:
       - DMARC_IMAP_USER=${DMARC_IMAP_USER:-dmarc@performancewest.net}
       - DMARC_IMAP_PASS=${DMARC_IMAP_PASS}
       - FROM_EMAIL=Performance West <noreply@performancewest.net>
+      # Cold-campaign operator exclusion (scripts.build_trucking_campaigns).
+      # After the Jun 2026 no-DKIM incident (campaign mail went out unsigned and
+      # was junked/blocked) DKIM is fixed, so we re-send to the whole now-signed
+      # audience but still hold Google's consumer inboxes back while their
+      # reputation recovers. Empty list ("") => exclude nobody; unset => default
+      # warmup exclusion (Google+Microsoft+consumer MX). Microsoft/Hotmail and the
+      # long tail are intentionally INCLUDED here.
+      - MAIN_EXCLUDE_OPERATORS=google
       - CRYPTO_SWEEP_ADMIN_EMAIL=${ADMIN_EMAIL:-ops@performancewest.net}
       - USAC_USERNAME=${USAC_USERNAME}
       - USAC_PASSWORD=${USAC_PASSWORD}