Rebuilds mailglass_suppressions from the append-only event ledger for one tenant.
Default mode applies missing suppression rows. Pass --dry-run to preview
counts without writing. Pass --verbose to print candidate-level detail for
the explicit tenant you selected.