HOLD: prepare AEON tailnet mobile pairing

[StephGlansberg]

Outcome

Prepares the existing Buzz mobile NIP-AB pairing path and all six disabled AEON workers for the canonical tailnet authority wss://architects-mac-mini.tail757661.ts.net. Adds the existing buzz-pair-relay binary as an opt-in, loopback-only Compose profile.

HOLD — no live apply

This PR does not change Tailscale Serve, the production community host, relay environment, Desktop config, installed LaunchAgents, Gateway, or any running worker. Pairing advertisement remains commented by default.

Fleet resume checklist

• Wait until the ACP trusted-envelope repair and Nexus canary lane releases the runtime lock.
• Snapshot the complete generated Fleet diff and current Tailscale Serve state.
• Update the one community host and relay/Desktop/worker/mobile authority together.
• Start the pairing profile, verify loopback port 5000, then route only /pair to it.
• Route HTTPS 443 / to relay port 3000; keep Funnel off.
• Read back NIP-11, WebSocket auth, media authority, and pairing URL.
• Pair mobile by QR + matching SAS and prove text/thread, presence/typing, observer, deep link, media, and reconnect.

Proof

• AEON worker tests: 15/15
• buzz-pair-relay: 51/51
• Focused mobile pairing/media/deep-link/observer tests: 99/99
• Compose profile render verified (entrypoint, loopback-only port, opt-in profile)
• Independent review: no actionable findings
• git diff --check: green
• Full just ci reaches an inherited Desktop file-size blocker in unchanged desktop/src-tauri/src/archive/mod_tests.rs (1303 lines; limit 1208). Pre-push Rust and Desktop Tauri tests passed.

Does not claim Gateway, Nexus canary, other Aspects, Concilium, A2A, or live mobile activation.