fix(projects): deliver issue mentions to managed agents

[ScaleLeanChris]

Fixes #2462.

Controlling Linear issue: BAC-109

Summary

• Publish a Project issue comment as a channel-scoped kind 9 event when it mentions an authorized managed agent.
• Give buzz-acp the originating issue and repository context.
• Add buzz issues comment so the agent reply preserves the issue e, repository a, and channel h tags.
• Preserve pull-request review decisions and monotonic Project comment ordering across legacy kind 1 and agent-addressed kind 9 comments.
• Add one core relay-backed regression for the complete delivery contract.

This supersedes only the #2462 portion of #2498. It preserves that PR's correct kind 9 plus channel h direction, while leaving its unrelated mesh-demo and Builderlab changes separate. Thank you to @Chessing234 for the original investigation and implementation direction.

The response now gets back to where it once belonged: the originating Project issue.

Authorization model

• Delivery fails closed unless the repository is bound to a Buzz channel.
• The relay authorizes the comment author against that channel.
• The mentioned agent must be an authorized channel member.
• buzz-acp retains its channel-scoped subscription.
• This does not add a global p-tag subscription or turn arbitrary mentions into agent tasks.

Verification

Rebased onto current main at c363ce13c. The conflict resolution preserves the current semantic prompt framing and Projects CLI guidance together with the issue and repository context added by this PR.

• cargo check -p buzz-acp -p buzz-cli --tests: passed.
• pnpm -C desktop typecheck: passed.
• cargo test -p buzz-cli issues --lib: 5 passed, 0 failed.
• just ci: passed on commit cf3e44a0c856c071482ce1bc725e973b5fbd30a1, including all required Rust, Desktop, Web, Mobile, format, lint, build, and security-script checks.
• cargo test -p buzz-acp authorized_project_issue_mention_round_trips_through_acp_contract -- --ignored --nocapture: the current live rerun remains environment-blocked because no local relay is available. The same focused regression passed before the earlier rebase. A fresh live run is still required before treating the end-to-end verifier as current.

The focused regression publishes an authorized Project mention, drives it through the production EventQueue, observes exactly one ACP session/prompt with issue and repository context, publishes the response through the real CLI dispatch, and verifies one reply attached with the original h, e, and a tags after a later legacy kind 1 comment.

Compatibility and privacy

• Ordinary plaintext Project comments remain compatible.
• Existing pull-request review decision tags and ordering remain intact.
• Current Projects assignment events remain compatible after the rebase.
• No credentials, local files, or environment values are included in events.
• No scheduler, file scan, upload path, or new global subscription is introduced.