calendar: use himalaya wrapper for email sending (defense-in-depth)

cal_tool.py now calls himalaya.sh wrapper instead of himalaya directly,
so recipients are validated at both the calendar layer (contacts.py
resolve) and the himalaya layer (wrapper header parsing).

skills/calendar/scripts/cal_tool.py

@@ -65,9 +65,12 @@ def _sync_calendar():
         print("Warning: CalDAV sync failed (will retry on next heartbeat)")
 
 
+HIMALAYA_WRAPPER = Path(__file__).resolve().parent.parent.parent / "himalaya" / "scripts" / "himalaya.sh"
+
+
 def _send_email(email_str, account=None):
-    """Send a raw MIME email via himalaya message send (stdin)."""
-    cmd = ["himalaya"]
+    """Send a raw MIME email via himalaya wrapper (validates recipients)."""
+    cmd = [str(HIMALAYA_WRAPPER)]
     if account:
         cmd += ["--account", account]
     cmd += ["message", "send"]