Add first-class Buzz outbound support

[olegbrok]

Outcome

Adds the first native Buzz outbound increment while keeping the operator path to one owner-controlled bind. Bound agents can use the existing generic send, thread, and react surfaces; no agent-facing Buzz configuration surface or parallel messaging API is introduced.

Built from the FINAL v5 security spec at SHA-256 33e86969d9189c6f113546e5d26b893feb419b83d4c1d9fbcc66d3ff3f54e21e.

What changed

• Adds buzz_identities to the agent registry with canonical unique x-only pubkeys, immutable owner-derived ToS authority provenance, and XChaCha20-Poly1305 private-key envelopes bound by AAD to agent + stored pubkey.
• Adds one owner-session-only bind operation plus redacted list/read/disable lifecycle routes. Internal agent HMAC cannot mint or modify the authority record.
• Adds a native Nostr/NIP-98 Buzz adapter integrated into generic send, thread, and react broker routes.
• Normalizes every parser-matching ASCII @word in the final composed payload before signing, with metadata-only rewrite logs.
• Implements the kind-20002 reference-only top-level reply fallback from verified stored metadata; raw ephemeral content is never read into the fallback.
• Makes Buzz signing/runtime dependencies base-install requirements and refuses registration with owner notification if an installed module cannot actually load.

Relay compatibility burn-down

Read-only probes against the live Buzz rig confirmed:

• plain-client WebSocket NIP-42 authentication and a verified kind-9 subscription event;
• NIP-98 POST /query returning a BIP340-verified event through this native adapter;
• the existing CLI wire shapes for send/thread/react: kind 9 + h, four-field reply e, and kind 7 reaction e.

No live /events publication was performed.

Validation

• Buzz-focused suite: 33 passed
• Existing broker/messaging overlap: 25 passed
• Registry/database-security/auth overlap: 215 passed
• Environmental dream-runner failure rerun with intended SDK/shared-MCP overrides: 1 passed
• Broad partial run before stopping the environment-driven slow block: 833 passed, 2 skipped; its one failure was the same shell-forced tmux/shared-port case above
• Ruff, git diff --check, uv lock --check, uv pip check, source compile, sdist build, and wheel build passed

Boundaries

This is outbound increment 1 only. Inbound-as-native-chat remains increment 2. No production identity was bound, no live channel event was posted, and this draft does not authorize merge or deploy.