Follow-ups from #900: ack usage names --agent; tier check in the exported ack/nack helpers #903

Follow-ups from the review of #900 (non-blocking), tracked here as one issue:

1. tps mail ack usage names a positional agent the parser does not read. The usage line says tps mail ack <id> [agent], but the command takes the agent from --agent. The fix makes the usage line show [--agent <id>], matching nack and the parser.
2. The exported ack/nack helpers carry no trust-tier check of their own. fix(mail): say why check re-delivers an unacked message (#340) #900 scopes its external-tier refusal to the ack/nack commands and ackable mail, and says the broader policy is deferred. The fix decides whether each exported helper enforces the same refusal itself, so a caller other than the CLI command cannot skip it. If they should, it adds the check and a test per helper.

Refs #340, #900.