PR-659 follow-ups: argparse + usage.md forensic→failure cleanup

- cli.py argparse: 'aggregate or forensic' → 'aggregate or failure',
  '--strip-attachment-payloads' help: 'forensic' → 'failure'
- docs/source/usage.md: stray 'forensic reports' → 'failure reports'
- CHANGELOG.md: call out the deliberate retention of the IMAP archive
  subfolder name 'Forensic' so existing deployments don't end up with
  a split archive across Forensic/ and Failure/

CHANGELOG.md

@@ -31,6 +31,7 @@ Forensic reports have been renamed to failure reports throughout the project to
 
 - Old function/type names preserved as aliases: `parse_forensic_report = parse_failure_report`, `ForensicReport = FailureReport`, etc.
 - CLI config accepts both old (`save_forensic`, `forensic_topic`) and new keys (`save_failure`, `failure_topic`)
+- IMAP archive subfolder name is intentionally kept as `Forensic` (under `archive_folder`) so existing deployments don't end up with a split archive across `Forensic/` and `Failure/`.
 - RFC 7489 reports parse with `None` for DMARCbis-only fields
 - **Updated dashboards with queries are backward compatible**: queries match data indexed under both old (`dmarc_forensic*` / `dmarc:forensic`) and new (`dmarc_failure*` / `dmarc:failure`) names, so dashboards show data from before and after the rename:
   - **OpenSearch Dashboards**: Index pattern uses `dmarc_f*` to match both `dmarc_forensic*` and `dmarc_failure*`

docs/source/usage.md

@@ -651,7 +651,7 @@ imports more predictable:
 - Use `mailbox.since` to process reports in smaller time windows such as `1d`,
   `7d`, or another interval that fits the backlog. This makes it easier to catch
   up incrementally instead of loading an entire mailbox history in one run.
-- Set `strip_attachment_payloads = True` when forensic reports contain large
+- Set `strip_attachment_payloads = True` when failure reports contain large
   attachments and you do not need to retain the raw payloads in the parsed
   output.
 - Prefer running parsedmarc separately from Elasticsearch or OpenSearch, or

parsedmarc/cli.py

@@ -1630,10 +1630,10 @@ def _main():
     arg_parser.add_argument(
         "file_path",
         nargs="*",
-        help="one or more paths to aggregate or forensic "
+        help="one or more paths to aggregate or failure "
         "report files, emails, or mbox files'",
     )
-    strip_attachment_help = "remove attachment payloads from forensic report output"
+    strip_attachment_help = "remove attachment payloads from failure report output"
     arg_parser.add_argument(
         "--strip-attachment-payloads", help=strip_attachment_help, action="store_true"
     )