fix(desktop): authorize external channel-member mentions at send time

[cmyk]

Summary

External Gateway agents can be authoritative members of a channel while their relay directory metadata still has stale or missing channelIds. In that state Buzz hides a legitimate member from mention autocomplete, creating a circular dependency: the agent cannot receive a canonical mention until its directory metadata is repaired manually.

This change lets an authoritative channel roster supplement directory channel metadata for autocomplete, without weakening the existing authorization boundary:

• the agent must still satisfy relay-directory identity, respondTo, allowlist, owner/build policy, and exact-pubkey checks;
• cached roster data is usable only when present, error-free, and not being refetched;
• send time always refetches directory policy and the authoritative channel roster, and fails closed on errors or membership removal;
• user-confirmed Invite uses two phases: fresh directory/owner-policy validation before adding the agent, then fresh roster validation after the mutation before emitting the p tag;
• ordinary nonmembers remain excluded.

The result is a canonical exact-pubkey p tag for an authorized external channel member, while stale caches and revoked membership cannot authorize a send.

Related issue

Security/reliability follow-up to #5681.

The basic eligibility slice overlaps #5806, but that PR does not implement authoritative-roster readiness or fresh fail-closed send-time authorization. This contribution is intentionally separate and focused on that boundary.

Testing

Verified on current block/buzz main caa64b5e8f584a740e331887a5dd1cda32bcb958 at commit 7e126e0f88d5125062e85c98ae9570c31c267ae3:

• pnpm test: PASS
• pnpm typecheck: PASS
• pnpm build:e2e: PASS
• Biome on all seven changed files: PASS
• git diff --check: PASS
• complete mentions.spec.ts Playwright coverage: 67/67 passed
• focused security and managed-agent compatibility Playwright coverage: 7/7 passed
  • roster-authorized agent with stale directory channels emits canonical p tag
  • membership removed after selection emits no agent p tag
  • invited relay-only allowlisted agent emits its p tag after authoritative membership is established
  • directory revocation during send emits no agent p tag
  • existing persona agent remains addable/startable without recreation
  • nonmember managed agent is added and started before send
  • nonmember provider-managed agent is deployed before send