feat(cli): add agents attest and agents register for agents run outside Desktop

[pardhaponugoti]

Summary

Agents run outside Buzz Desktop (buzz-acp on a VPS/container/CI, against a hosted community) connect fine and answer DMs, but never appear in any client's @-mention picker — so nobody can tag them in a channel. Refs #2508, #3277, #4489.

The picker is fed by the relay agent directory, which needs three signed records:

1. the agent's kind:0 profile carrying a NIP-OA auth tag naming the owner,
2. relay-signed channel membership,
3. an owner-signed kind:30177 policy record (d = agent pubkey; name, parallelism, respond_to).

Desktop publishes (1) and (3) for the agents it manages. For a headless agent nothing does, and the CLI had no way to produce either. This PR adds both, plus the missing docs.

Changes

• buzz agents attest <AGENT_PUBKEY> [--conditions] — run as the owner; prints the NIP-OA auth tag (owner pubkey + Schnorr sig over the agent pubkey, no secret). The agent sets it as BUZZ_AUTH_TAG, which buzz-acp already uses for relay admission and owner resolution, and which buzz users set-profile already attaches to the kind:0. Local only, no network.
• buzz agents register <AGENT_PUBKEY> --name … --respond-to … [--parallelism] [--force] — run as the owner; publishes the kind:30177 record with the same content projection Desktop's ManagedAgentEventContent writes. Preflight fetches the agent's kind:0 and refuses unless its sole auth tag names the signer (reuses the archive path's extract_auth classifier, so diagnostics match agents archive); --force skips it. Signs via sign_event_unchecked so an ambient BUZZ_AUTH_TAG is never injected into an owner-authored record.
• Docs — new "Running Outside Buzz Desktop (hosted community)" section in crates/buzz-acp/README.md walking through all four steps, plus rows in the CLI README.
• Tests — event kind/d-tag/no-auth-tag, content projection, and preflight accept/reject cases.

Verified

End to end against a hosted community (*.communities.buzz.xyz): three agents run with buzz-acp on a Hetzner box. Before: channel members with green presence, @ picker never lists them, plain @Name text sends no p tag, agents only reachable via DM or subscribe=all. After publishing the 30177 record per agent: all three appear in the picker on a Desktop that does not manage them, mentions arrive p-tagged, and BUZZ_ACP_SUBSCRIBE=mentions works.

cargo fmt, cargo clippy -p buzz-cli --all-targets -D warnings, cargo test -p buzz-cli clean.

Not in this PR

• An agents unregister (kind:5 deletion of the 30177 coordinate, as Desktop does on delete) — happy to add if wanted.
• Desktop UI for adding a non-managed agent to a channel; today the agent must buzz channels join itself (regular channels only).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WjULFPqiAuV4SV67mZgMAi

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 7c789dee09d198469bded1cb5be902eaf5562ad9...e697c37052a9666e034f9627ffc41c9a55a966bb.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review e697c37052a9666e034f9627ffc41c9a55a966bb to authorize a new review.
Any previous review applies only to its recorded range.