fix: make Codex delivery resilient to sandbox DNS - #4983

Summary

• keep Codex workspace-write turns network-enabled only when the adapter proves it honors Buzz's explicit network and writable-root policy
• add a harness-owned broker that transports the exact already-signed Buzz event when the sandboxed CLI has a degraded or ambiguous relay outcome
• verify relay acceptance and exact event readback for both direct and brokered delivery
• preserve message content, channel/thread tags, mentions, attachments, signer, and event id without reconstructing or re-signing the payload

Why

Kamaljinder's Luna turns continued to run and compose replies, but normal buzz messages send calls ran inside a Codex workspace-write sandbox whose per-turn policy disabled network access. Earlier sends only worked when the model happened to request an elevated retry. After a fresh session stopped choosing that escape, direct replies and heartbeat publications silently failed.

This change makes the intended workspace-write network policy explicit and adds a signed-event delivery contract outside the model sandbox so publishing no longer depends on model-selected escalation.

Safety properties

• direct relay delivery remains the primary path
• broker accepts only a bounded message-kind allowlist and validates signer, signature, event id, membership, channel tags, timestamps, size, capability, and request correlation
• broker publishes the exact signed event, performs exact readback, and never rebuilds or re-signs assistant prose
• bounded queue, scan, response, timeout, lease, symlink/reparse, and stale-file handling
• stock adapters fail closed at startup; the required adapter capability is versioned

Validation

• env -u BUZZ_ACP_LAZY_POOL ./bin/just ci
• full repository CI passed at 708054d8630ca0536e1e03a70199a2f935fef3a3
• release binaries built and SHA-256 pinned for live Luna acceptance
• independent security/correctness review completed with no remaining actionable findings

Optional outbound mention guard

• add the generic BUZZ_OUTBOUND_TOP_LEVEL_MENTION_PUBKEYS policy for new stream and forum messages; no agent or recipient identity is hard-coded
• resolve one canonical policy value and propagate it consistently to the agent child, MCP subprocess, direct CLI, and harness broker
• require top-level messages to carry exactly the configured p-tag set; reject missing, additional, malformed, or duplicate tags before relay submission
• allow unmentioned replies only after verifying the signed parent exists in the same channel; mentioned replies must still match the configured set
• leave edit and diff payloads unaffected

Path-level tests cover direct and broker rejection, matching top-level delivery,
signed same-channel replies, forged or cross-channel reply rejection, policy
precedence and propagation, and edit/diff compatibility.

Routing-policy live acceptance

• Kamaljinder's Desktop-managed signing context ran the validated 708054d8
  candidate with BUZZ_OUTBOUND_TOP_LEVEL_MENTION_PUBKEYS set to Boofus only.
• A top-level wrong-recipient attempt naming Ultra Beefus failed locally with the
  mention-policy error and produced no matching KJ event on the relay.
• The matching Boofus-only probe was accepted exactly once and read back exactly
  once as KJ-signed event
  ee871edddfba2ffdb2d8249f5a86be446749d5ab6878ccd5b4d5d7c6ae3ce3dd.
• The signed event is kind 9, has the Inbox triage h tag, no e tag, and
  exactly one p tag: Boofus
  (7ab52828888397487758803330ded03256c25a98025642fe35382f030b930711).
• KJ was then restored to the normal 3,600-second cadence; startup readback shows
  32 workers configured, 31 channel subscriptions, relay connection, online
  presence, and the Boofus-only guard in the live process environment.

Dependency and merge gate

Paired adapter change: agentclientprotocol/codex-acp#368.

Do not merge this PR until the compatible adapter is available to the Buzz package/runtime. Live acceptance must also pass on Luna with a fresh session: one channel mention, one DM, and one forced material heartbeat, each accepted once and read back from the intended destination without require_escalated or EAI_NONAME.