perf(acp): trace mention-to-reply latency

[BradGroux]

Summary

• add process-local monotonic observer boundaries for relay receipt, queue admission, ACP session resolution, prompt dispatch, first semantic model/tool output, first reply fanout, and turn completion
• correlate those boundaries into content-free mention_reply_latency samples with rolling warm/cold p50, p95, and max stage summaries
• let observer-enabled mention subscriptions receive self-authored kind-9 replies for telemetry while preserving the normal self-dispatch guard
• document a repeatable deterministic check and live warm/cold benchmark procedure

Measurement scope

This first slice explicitly measures harness_relay_receipt to harness_relay_fanout. It does not yet claim sender-publish-to-recipient-render end-to-end timing. Durations use one process-local monotonic clock; RFC3339 and Nostr timestamps remain correlation metadata only.

The semantic timing events contain IDs, path classification, durations, and sample counts. They do not include message content, prompts, model output, credentials, or tool arguments. Existing raw acp_read / acp_write observer events are unchanged and remain outside this new redaction guarantee.

Verification

• cargo test -p buzz-acp --no-fail-fast — 579 passed
• cargo clippy -p buzz-acp --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• just ci — Rust, Desktop, web, and mobile gates passed; mobile finished with 525 tests passed

Follow-up

This intentionally uses Refs #2386 rather than closing the issue. #2386 should remain open until the outer sender-publish and recipient-render/relay-acceptance boundaries, production warm/cold baselines, explicit budgets, and a scheduled or blocking regression job land.

A live hosted-relay benchmark was not run in this PR; the self-reply subscription shape and correlation logic are covered deterministically, and the runbook defines the opt-in real-provider procedure.

Refs #2386