More defense-in-depth folds:
• R-HIGH-1: short-key floor ≥128 bytes (smallest viable RSA-1024 DER). Catches `p=` (empty) and `p=Qg==` (1-byte) substitution attacks where a hostile DNS-layer actor injects trivially-short keys.
• R-HIGH-2: multiple v=DKIM1 records emit `errorCode: "multiple-dkim-records: N"` and route to LOW evidenceGap. Pre-fold the code silently parsed dkimRecords[0] only.
• Part B: DMARC alignment classifier projects whether the identity's actual config (DKIM SigningEnabled custom MailFrom presence) can ever satisfy adkim/aspf alignment.