fix(relay): disconnect removed members cluster-wide

[100yenadmin]

Closes #6

Summary

• invoke the existing community-scoped cluster disconnect immediately after relay membership is durably removed
• use the signed admin event ID and a stable non-sensitive disconnect reason
• treat a repeated removal on a membership-gated relay as an idempotent success and re-fan-out the disconnect, while retaining owner and role-protection errors
• reject absent-target retry fan-out on open relays, where row absence does not prove prior removal
• reject a NotFound retry when the target is a NIP-OA virtual agent authorized through an owner
• publish NIP-43 removal announcements only for a newly deleted row
• preserve the existing tenant fence so the same key remains connected in other authorized communities
• record each connection's effective relay-member principal (the direct key or a NIP-OA agent's verified owner)
• recheck that durable principal before every WebSocket EVENT
• revalidate live principals periodically, with a hard 15-second maximum interval, so a pod that misses Redis pub/sub still closes idle sessions

Local proof

• cargo test -p buzz-relay removal_disposition
• cargo test -p buzz-relay membership_principal_disconnect
• cargo test -p buzz-relay durable_membership_revalidation
• cargo test -p buzz-relay membership_revalidation_interval
• cargo test -p buzz-relay disconnect_pubkey_is_fenced_to_the_banning_community
• cargo test -p buzz-pubsub conn_control
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

The broader local cargo test -p buzz-relay run reached 730 passed / 27
ignored, with 8 existing database-backed media/admin tests failing because no
local Postgres service was available (Sqlx(PoolTimedOut)). Canonical GitHub CI
is the broad repository gate.

Exact-head gates

• Head: 0a2ba218f4175124af77b9e523e14a6c6ff8a7df
• Canonical CI: https://github.com/electricsheephq/buzz/actions/runs/30039828305 — success
• CodeQL: https://github.com/electricsheephq/buzz/actions/runs/30039824068 — success
• Independent semantic review: initial pass plus two targeted deltas; all three verified findings fixed now, no unresolved gate-relevant finding

The separate Docker workflow
https://github.com/electricsheephq/buzz/actions/runs/30039828052 failed only
while exporting build cache layers to upstream ghcr.io/block/*
(permission_denied: The requested installation does not exist). That fork
package-permission limit is outside this generic source diff.

Proof boundaries

This is a generic upstream-candidate staging PR in the Electric Sheep fork. It
is not merged, submitted to block/buzz, released, deployed, or runtime/customer
proof.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 293579e9-dee4-4b5a-928c-58a79f946f25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6-cluster-member-revocation

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

This pre-reset staging PR is closed as superseded by merged upstream-first reset PR #37 and the current thin-adapter tracker #1/#36.

No code is being deleted. The branch and review history remain available. Retained behavior was replayed narrowly in #37; dropped managed brokers, blanket guards, duplicate UI, and control-signed routine collaboration must not be revived from this PR.