feat(cli): add agents archive/unarchive/archived subcommands

[wpfleger96]

Summary

NIP-IA identity archive lifecycle for the CLI: kind 9035 archive requests, kind 9036 unarchive requests, and kind 13535 archived-identities snapshot verification.

New subcommands

buzz agents archive <PUBKEY> [--reason <code>] [--replaced-by <PUBKEY>] [--content <text>]
buzz agents unarchive <PUBKEY> [--reason <code>] [--content <text>]
buzz agents archived

SDK layer (crates/buzz-sdk/src/builders.rs)

• build_archive_identity_request / build_unarchive_identity_request — produce EventBuilder for kind 9035/9036 with NIP-70 ["-"] protection, ["p", target], optional ["reason", code], optional ["replaced-by", pubkey] (archive only), and optional ["auth", ...] owner attestation tag.
• check_reason — 64 UTF-8-byte boundary (matches desktop's reason.len() byte check). Rejects control characters.
• check_auth_tag_shape — structural validation of the auth label, 64-hex owner, 128-hex signature.
• .allow_self_tagging() on both builders so nostr 0.44's default same-pubkey p-tag scrub doesn't strip the self-archive path.
• 8 unit tests: tag layout, 64/65-byte reason boundary, control-char rejection, replaced-by == target rejection, auth-tag shape, unarchive layout with self-path signing, no replaced-by on unarchive.

CLI dispatch (crates/buzz-cli/src/commands/agents.rs)

• Dispatch restructured: BUZZ_AUTH_TAG requirement moved inside draft-create/draft-update only. Archive/unarchive/archived work without it (Will runs without BUZZ_AUTH_TAG).
• Deterministic consent resolution (resolve_auth): mirrors desktop's maybe_owner_auth_tag. Self path (target == signer) → no auth tag. Third-party path → fetch target's kind:0, attach auth tag iff the kind:0 carries exactly one auth-labeled tag, it is structurally valid, and its owner matches the signer. Zero, multiple, malformed, or nonmatching auth tags → bare request (not error). One deterministic request per invocation, no fallback.
• Non-ambient signing seam (sign_event_unchecked in client.rs): signs the EventBuilder without injecting the ambient BUZZ_AUTH_TAG into the event — the NIP-IA auth tag is the target's owner attestation, not the runner's NIP-OA delegation. The x-auth-tag HTTP header on submit_event is unchanged (membership admission preserved).
• Unauthenticated GET (get_public in client.rs): no NIP-98 or x-auth-tag — used for NIP-11 relay info fetch.

Archived snapshot (cmd_archived)

Tri-state trust verification:

• State 1 — trusted-empty: NIP-11 self valid, query succeeds, no 13535 exists → {"archived": []}, exit 0.
• State 2 — trusted-parsed: snapshot passes all structural checks → parsed pubkey list, exit 0.
• State 3 — untrusted/error: NIP-11 fetch failure, malformed self, wrong kind, wrong author, invalid id/sig, or missing/duplicate/malformed NIP-70 - tag → error exit nonzero with the specific trust failure named.

Structural checks: kind == 13535, author == NIP-11 self, exactly one NIP-70 marker with any --labeled tag of arity != 1 rejected as malformed, event id + signature verification via event.verify(). NIP-11 self is hex64-validated and lowercased once (normalize_relay_self_hex); the normalized form feeds both the authors query filter and the author comparison. Non-hex64 p tags silently dropped from trusted snapshots.

Changes

File	Description
crates/buzz-sdk/src/builders.rs	+270/−3: SDK builders, reason/auth validation, 8 unit tests
crates/buzz-cli/src/commands/agents.rs	+680/−46: full dispatch rewrite with archive/unarchive/archived
crates/buzz-cli/src/client.rs	+158/−1: sign_event_unchecked + get_public + tests
crates/buzz-cli/src/lib.rs	+61/−2: clap variants + updated inventory test (agents: 2 → 5 subcommands)

Co-authored-by: Will Pfleger pfleger.will@gmail.com
Signed-off-by: Will Pfleger pfleger.will@gmail.com