Route attacker-check reports to root@jayfield.org, add dated archive

root@jayfield.org didn't resolve to anything (missing from both
/etc/aliases and vmail.aliases) - added it as a new alias to
jens@jayfield.org, matching the existing postmaster/hostmaster/
webmaster/wlan pattern, so the weekly report doesn't just bounce.
Also added per-run dated report files under
/var/log/attacker-check/reports/ alongside the existing CSVs, for a
plain-text historical archive browsable by date.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -66,13 +66,21 @@ routine pending package upgrades, don't fail the run).
 history to cover a full week regardless of exactly when logrotate's daily
 midnight run lands relative to the cron job) for the past 7 days and
 turns it into two append-only CSVs for longitudinal analysis, plus a
-human-readable weekly summary emailed to `jens@jayfield.org`:
+human-readable weekly summary emailed to `root@jayfield.org` and saved
+as a dated report file:
 
 - `/var/log/attacker-check/per_ip_weekly.csv` — one row per (jail, IP)
   per week: event count, first/last seen, `/24` subnet, and interval
   statistics (mean, stdev) between repeat hits.
 - `/var/log/attacker-check/per_jail_weekly.csv` — weekly rollup per jail:
   total events, distinct IPs, distinct `/24`s, new bans.
+- `/var/log/attacker-check/reports/<week-ending-date>.txt` — the full
+  human-readable report for that run, one file per date.
+
+`root@jayfield.org` didn't resolve to anything before this (not in
+`/etc/aliases`, not in the `vmail` aliases table) — added it as a new
+`vmail.aliases` row → `jens@jayfield.org`, matching the existing
+`postmaster`/`hostmaster`/`webmaster`/`wlan` pattern.
 
 Two detection heuristics run on top of the raw data, both modeled
 directly on real campaigns found earlier this engagement (see `TODO.md`):