Log rate-limited Buzz policy drops

[olegbrok]

Summary

• make the existing Buzz inbound policy drops loud for foreign p targets, unverified senders, and unknown event kinds
• emit one bounded journal line with a stable reason, the community-scoped sender principal shortened to a 12-character pubkey prefix, and the channel UUID
• rate-limit logs for 15 minutes per (sender, channel, reason) tuple, then report how many repeats were suppressed; cap retained tuple state at 4,096 entries
• preserve the existing default-deny policy and all return values; verified-contact management and third-party approval remain untouched

This implements increment A of #1025 only. It intentionally does not close #1025 because increments B and C remain owner-gated.

Root cause

The three policy decisions returned their existing drop statuses without calling the module logger. In the field case, that made both an owner message carrying a foreign p tag and a channel message from a non-verified contact disappear without any operational trace.

Validation

• ruff check . — passed
• python -m pytest tests/test_buzz_inbound.py tests/test_buzz_inbound_poller.py -q — 33 passed
• python -m py_compile src/pinky_daemon/buzz_inbound.py tests/test_buzz_inbound.py — passed
• git diff --check and staged diff check — passed

The repository-wide python -m pytest -q run reached the documented unrelated #1024 hermeticity defect: tests/test_api.py::TestAPI::test_manual_dream_uses_full_persisted_conversation_history escaped its SDK mock through this box's tmux transport and launched a real Claude process. The run was stopped after reporting 1 failed, 840 passed, and 1 skipped; this PR does not touch that path.

🤖 Opened by Kuzya

[olegbrok]

Orchestrator pass: exactly the right shape — reason + truncated sender + channel and NOTHING else (no message content in any line, full pubkey asserted-never-logged by test), 15-min window with suppressed-count on re-log, LRU cap on the tracking dict so rotating senders can't grow it unbounded, injectable clock, and defensive parsing of hostile events (hex-checked pubkey, single-h-tag UUID validation, fail-to-unknown). All three #1025-A drop classes covered (foreign_p, unverified_sender, unknown_kind) with zero policy behavior change. Awaiting Murzik gate + final-SHA CI; merge stays with me.

🤖 Barsik