Harden contract validation, STARTTLS edge cases, and rule output

checker/starttls_imap.go

@@ -36,6 +36,10 @@ func starttlsIMAP(conn net.Conn, sni string) error {
 			supportsSTARTTLS = true
 		}
 		if strings.HasPrefix(line, "A001 ") {
+			rest := strings.TrimSpace(line[len("A001 "):])
+			if !strings.HasPrefix(strings.ToUpper(rest), "OK") {
+				return fmt.Errorf("CAPABILITY rejected by server: %s", rest)
+			}
 			break
 		}
 	}