Email Security: document customer sample submission

[maximelb]

What

Documents Email Security customer sample submission: an opt-in way for analysts to copy one message at a time to LimaCharlie so detection can improve.

• New page docs/email-security/sample-submission.md: why it exists, how to opt in (mailsec_policy record of type sample_sharing), who can submit (mailsec.act; D&R rules, automations and the AI agent cannot), the three categories, what is kept, where, for how long (400 days), restricted, recorded access and customer-visible access counts and timestamps, how to withdraw, what happens when the organization is deleted, the routes, the CLI commands, the refusal messages and a short FAQ.
• policy.md: the sample_sharing record type, its composition, and sample submissions in the list of what a tenant purge removes.
• api-reference.md: the submission routes and the two new message actions.
• cli.md: the new commands and a note on what they do. messages.md and index.md: one-line pointers. mkdocs.yml: nav entry.

Notes for review

• The CLI commands documented here are added by the open CLI/SDK change in python-limacharlie#411 and need an API release that serves the new routes. Merge this after that release, or expect the commands to be missing from the latest stable CLI until then.
• I did not add a console walkthrough: the console UI lands separately, so the page only states that withdrawal is possible from the console and documents the record, CLI and API.
• Nothing in the page goes beyond what the feature does: no claims about interaction with alert-only mode or with the organization's retention settings.

Risk

Docs only.

Tests

mkdocs build --strict passes; list-numbering check, release feed check and pytest tests pass; markdownlint-cli2 reports 0 issues on the touched files.

🤖 Generated with Claude Code

[maximelb]

/lc-review

[maximelb]

/lc-review

[maximelb]

/lc-review

[maximelb]

/lc-review

[maximelb]

/lc-review

[maximelb]

/lc-review

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/documentation ace2ea0…13194c9 — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.