Refs #2386.

Why this PR exists

Four simple agent replies in #2386 took 13–31 seconds, but the available event
timestamps only showed the beginning and end of each turn. That left no way to
tell whether the delay happened in queueing, runtime startup, model work, or
reply publication.

This PR adds the first in-process timing slice after Buzz receives the mention.

What changed

• Record process-local monotonic boundaries for relay receipt, queue admission,
  ACP session resolution, prompt dispatch, first semantic model or tool output,
  first reply fan-out, and turn completion.
• Correlate those boundaries into content-free mention_reply_latency samples.
• Report rolling warm/cold p50, p95, and max summaries for each stage.
• Let observer-enabled mention subscriptions receive self-authored kind-9
  replies for telemetry while preserving the normal self-dispatch guard.
• Document a deterministic check and an opt-in warm/cold live benchmark.

What this measures

This slice measures harness_relay_receipt through
harness_relay_fanout. It does not claim sender-publish-to-recipient-render
timing.

Durations come from one process-local monotonic clock. RFC3339 and Nostr
timestamps are correlation metadata only.

The new semantic timing events contain identifiers, path classification,
durations, and sample counts. They do not include message content, prompts,
model output, credentials, or tool arguments. Existing raw acp_read and
acp_write observer events are unchanged and remain outside this new redaction
guarantee.

Verification

• cargo test -p buzz-acp --no-fail-fast — 579 passed
• cargo clippy -p buzz-acp --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• just ci — Rust, Desktop, web, and mobile gates passed; mobile finished
  with 525 tests passed

What remains

#2386 should stay open until the outer sender-publication and
recipient-render/relay-acceptance boundaries are measured, hosted warm/cold
baselines and explicit budgets exist, and a scheduled or blocking regression
job is in place.

This PR did not run a hosted-relay benchmark. The self-reply subscription shape
and correlation logic are covered deterministically, and the runbook documents
the opt-in real-provider procedure.