docs(deliverability): document consumer-domain exclusion two-layer model + scrub

Records the Apple/iCloud addition, the builder-vs-list-based distinction, the
scrub_listmonk_consumer reconciliation tool + daily cron, and the 2026-06-19
first-run numbers (7,943 trucking + 21 HC stale consumer subs blocklisted).

docs/deliverability.md

@@ -202,6 +202,21 @@ doing since the data finally arrives.
   already blocklists hard bounces after 1 (`bounce.actions hard->blocklist`), so
   these self-clean, but pre-scrubbing the dirtiest segments before send avoids the
   reputation hit. See `data/` segment exports.
+- **Consumer-domain exclusion (two layers).** The authoritative list lives in
+  `scripts/_email_exclusions.py` (`BLOCKED_EMAIL_DOMAINS`): gmail/google, the full
+  Yahoo/Verizon-Media family, Microsoft consumer, **Apple/iCloud (added 2026-06-19)**,
+  dead/legacy ISPs, and the legal do-not-contact list.
+  1. *NEW selections:* the per-vertical builders filter it out of audience SQL and
+     `listmonk_import.py` refuses to import a blocked address.
+  2. *Already-imported subs:* LIST-BASED campaigns (FCC Direct Contacts list 3,
+     CRTC/USF blasts) can still hit consumer subs imported BEFORE a domain joined
+     the list. `scripts/scrub_listmonk_consumer.py` reconciles the live subscriber
+     table against the exclusion list and blocklists any ENABLED match (idempotent;
+     `--dry-run` supported; both `listmonk` + `listmonk_hc`). Runs daily 06:30 UTC
+     via `/etc/cron.d/pw-listmonk-scrub` (tracked at `infra/cron/pw-listmonk-scrub`).
+     First run 2026-06-19 blocklisted **7,943** trucking + **21** HC stale consumer
+     subs (1,321 iCloud, 267 gmail, etc.) that were leaking via the running CRTC
+     campaign. Re-run the scrub whenever you add a domain to the exclusion list.
 - **Don't re-expand IPs** until Postmaster Tools shows recovered reputation.
 - **Volume discipline:** keep the global 200/hr sliding window until reputation is
   green; concentrated low volume on one warm IP beats bursts.