feat(relay): gate kind 30178 team-catalog reads behind the shared tag

[wpfleger96]

Team catalog projections (kind:30178) embed every member's system prompt, so they need the same read gate personas already have: only the author sees an unshared event. The gate was hardcoded to kind:30175 at six read surfaces plus the SQL pushdown, so rather than adding a second special case it becomes kind-generic over SHARED_GATED_KINDS = {30175, 30178}.

Kind 30178

New parameterized-replaceable kind, addressed by (pubkey_o, 30178, team_id). It embeds sanitized member projections instead of referencing kind:30175 heads — a foreign reader of a shared team could not otherwise hydrate members whose own persona events are unshared or, for built-ins, absent entirely. kind:30176's wire body is untouched, so device sync keeps its contract.

Kind-generic shared gate

buzz_core::kind replaces is_persona_shared_kind / is_unshared_persona_event / persona_event_is_shared with SHARED_GATED_KINDS and the kind-agnostic is_shared_gated_kind / is_unshared_gated_event / event_is_shared. Every read surface consults the set:

Surface	File
REQ historical delivery + ids lookup	crates/buzz-relay/src/handlers/req.rs
Live fan-out	crates/buzz-relay/src/handlers/event.rs
COUNT fallback	crates/buzz-relay/src/handlers/count.rs
NIP-98 HTTP /query, /count, /search	crates/buzz-relay/src/api/bridge.rs
Pre-LIMIT SQL pushdown	crates/buzz-db/src/event.rs

The SQL clause generalizes from kind != 30175 to kind NOT IN (...) bound from SHARED_GATED_KINDS, still applied before ORDER BY … LIMIT so a page of newer private events cannot starve an older shared one off the candidate set. EventQuery::persona_reader is renamed shared_gated_reader and needs_persona_filtering to needs_shared_gate_filtering to match.

Because the buzz-core rename has consumers outside the relay, the four desktop call sites of persona_event_is_shared travel with it: desktop/src-tauri/src/commands/personas/pending.rs, desktop/src-tauri/src/event_sync.rs, and two in desktop/src-tauri/src/managed_agents/persona_events.rs. Each call is unchanged apart from the name — the persona shared projection behaves exactly as before.

Ingest validation

validate_persona_envelope splits into two reusable pieces — validate_shared_tag (exactly-two-element ["shared","true"], at most one occurrence) and single_bounded_d_tag (exactly one d tag, non-empty, <=64 chars, no ASCII control characters or whitespace). validate_team_catalog_envelope composes both; personas additionally keep the slug grammar ^[a-z0-9][a-z0-9_-]{0,63}$.

kind:30178 deliberately does not get the slug grammar. Team ids are UUIDs or built-in identifiers such as builtin-team:welcome, and the colon is not slug-legal; rewriting ids to fit would break NIP-33 addressing against the team's own kind:30176 head. The non-empty and exactly-one checks are load-bearing regardless — without them generic NIP-33 storage maps a missing d onto (pubkey_o, 30178, "") and every team overwrites its predecessor.

The exact two-element shared shape is enforced because the SQL visibility clause is JSONB containment (tags @> '[["shared","true"]]'), which would match a three-element superset such as ["shared","true","extra"].

kind:30178 is also added to the Scope::UsersWrite allowlist and to is_global_only_kind, so a stray h tag cannot channel-scope an owner-authored definition.

Deferred

kind:30176 is deliberately not a gate member. Its writers never emit shared, so catalog opt-in semantics do not describe it — it needs owner-private reads driven by an authenticated principal set, tracked as a separate follow-up.

Tests

• 19 new ingest.rs unit tests covering the 30178 envelope (UUID and colon d tags, 64-char boundary, non-ASCII bound, empty/valueless/duplicate/missing d, embedded newline, shared false/three-element/duplicate, scope and global-only membership).
• Persona regressions for the valueless ["d"] shapes, since the d-tag helper is shared by both validators.
• Existing kind.rs gate tests generalized and extended to assert the gate applies to 30178 as it does to 30175.
• New crates/buzz-test-client/tests/e2e_team_catalog.rs: 9 WS-level tests over a live relay covering author reads of unshared heads, foreign omission from REQ, ids-lookup denial, COUNT existence-leak, share and unshare transitions, and the mixed-kind filter case.
• .github/workflows/ci.yml adds --test e2e_team_catalog to the Relay E2E job so the new suite runs.

Docs

docs/nips/NIP-AP.md gains a "Team catalog projection: kind:30178" section and an "Ingest validation: kind:30178" subsection, records the gate as kind-generic, documents 30178 deletion vs. unshare semantics, and adds a security note that sharing a team exposes every member's instructions even when that member's own kind:30175 head is unshared.