Provision an isolated Agent Account mailbox for every tenant — a real grant_id per customer, grouped by workspace, with send identity, limits, and policy cleanly separated.
