feat(blog): add 'Your agent can't tell who sent that email'

[jiashuoz]

What

Adds today's blog post, "Your agent can't tell who sent that email", following the existing blog pattern:

• web/src/app/blog/from-is-a-claim/page.mdx - the post (~540 words)
• web/src/app/blog/posts.ts - registry entry (date 2026-09-07, 3 min read); sitemap picks it up automatically

Angle

The From line is a claim, not a fact - a support agent that trusts it will hand order data and refunds to anyone who types the right name. The post explains why the real signal is in the delivery checks (SPF / DKIM / aligned DMARC), then walks e2a's per-message evidence: header_from vs envelope_from, the nullable verified_domain DMARC-pass projection, and the full authentication detail. Includes the README's own limits (DMARC proves the domain, not the local part, person, or content; Reply-To never replaces header_from) and the webhook-consumer boundary (X-E2A-Signature + construct_event before trusting any field). Fourth post in the rotation: outbound gate -> delivery channels -> content screening -> sender identity. Every claim grounded in the repo README; no competitor named; no efficacy claims.

Verification

• npm run build (static export) succeeds; the new page prerenders at /blog/from-is-a-claim
• Visually verified by screenshot: the post page renders in the site's existing style and the post appears at the top of /blog

Not merged - review and merge when ready. Note: prod serves a pinned release, so the post won't be live until a release is cut and promoted.