Route attacker-check reports to root@jayfield.org, add dated archive

root@jayfield.org didn't resolve to anything (missing from both
/etc/aliases and vmail.aliases) - added it as a new alias to
jens@jayfield.org, matching the existing postmaster/hostmaster/
webmaster/wlan pattern, so the weekly report doesn't just bounce.
Also added per-run dated report files under
/var/log/attacker-check/reports/ alongside the existing CSVs, for a
plain-text historical archive browsable by date.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -3,6 +3,17 @@
 Outstanding hardening items (see `README.md` for the full service overview).
 Nothing here is urgent; all are low-risk, no-downtime changes.
 
+- [x] **Weekly attacker-summary report routing to `root@jayfield.org`** — done 2026-07-26.
+      `attacker-check.py`'s report email was pointed at `root@jayfield.org`, but that address
+      didn't resolve to anything (not in `/etc/aliases`, not in `vmail.aliases`) — would have
+      bounced every week. Added it as a new `vmail.aliases` row → `jens@jayfield.org`, matching
+      the existing `postmaster`/`hostmaster`/`webmaster`/`wlan` pattern. Also added per-run
+      dated report files (`/var/log/attacker-check/reports/<date>.txt`), alongside the two
+      existing append-only CSVs. Verified: `postmap -q root@jayfield.org
+      mysql:/etc/postfix/sql/aliases.cf` resolves correctly, a live re-run delivered to
+      `jens@jayfield.org` (`orig_to=<root@jayfield.org>` in the Postfix log) and wrote
+      `reports/2026-07-26.txt`.
+
 - [x] **BIND's own DNSSEC validation was broadly broken for signed domains** — found and fixed 2026-07-26
       while investigating why third-party apt repos (`download.docker.com`, `ppa.launchpad.net`) kept
       failing to resolve ("Temporary failure resolving") during prep for an OS release upgrade.