The forward attachment-list filter compared the raw (possibly bracketed)
Content-ID against the body's bracket-free cid: references, so a
bracketed cid with no inline disposition (Foxmail's octet-stream case)
slipped through as a regular attachment chip *and* got re-attached as
the matched inline part, sending the same blob twice. Normalize before
that comparison too, and strengthen the regression test to exercise Send
and assert on the actual outgoing htmlBody/attachments for both the
reply and forward paths.