docs: runbook fix #8 — telecom/transactional HTML-only plaintext fix + campaign 407 finding

docs/email-deliverability-runbook.md

@@ -209,3 +209,27 @@ All discovered during the post-incident technical audit; each fix is codified.
    `mail-pipeline` role + `playbooks/deploy-mail-pipeline.yml` deploy them all
    from the canonical repo copies (`infra/cron/`, `infra/postfix/`,
    `infra/monitoring/`, `infra/systemd/`, `scripts/*bounce*`). Commit `4dc5690`.
+8. **Telecom + transactional email was also HTML-only** — the campaign-builder
+   plaintext fix (#3) only covered Listmonk mass-mail. The telecom/filing/
+   customer-transactional path (499-Q reminders, RMD/FCC filing review links,
+   intake/completion/delivery/commission emails, order confirmations) builds its
+   own `MIMEMultipart` / nodemailer messages, and ~17 of them attached ONLY an
+   HTML part — a malformed single-part `multipart/alternative` and a spam signal.
+   Fixed at the source so all callers are covered:
+   - `scripts/workers/worker_email.py` `send_worker_email()` now auto-derives the
+     text/plain part from HTML via `_email_plaintext.html_to_text` when the
+     caller omits `text=`.
+   - 16 rolled-their-own Python senders (`scripts/workers/**`, `scripts/formation/
+     document_delivery.py`) attach an `html_to_text(...)` plaintext sibling
+     before the HTML part (`job_server` + `document_delivery` wrap text+html in an
+     `alternative` sub-part so PDF/DOCX still attach to the `mixed` root).
+   - `api/src/email.ts` gained a dependency-free `htmlToText()` and `sendEmail`
+     now defaults `text` to it (covers checkout/webhook HTML-only sends).
+   NB: telecom campaigns themselves are still **manually** created+sent in the
+   Listmonk UI (no send automation; `compliance_alert_list.py` /
+   `rmd_deficiency_campaign.py` only populate lists). The one telecom send to
+   date — campaign 407 "FCC Deficiency Report - FREEDOM249", Jun 08 — was
+   HTML-only AND sent inside the DKIM-broken window: 384 sent / 343 views / **0
+   clicks** (the same junked-mail signature as the trucking blasts). Any future
+   telecom UI campaign should set an altbody (Listmonk "Plain text" toggle) and
+   run through the same dead-ISP/suppression hygiene. Commit `b375385`.