fix(acp): authenticate stored workflow mentions

[justinharkelroad]

Summary

• backport the focused workflow-owner provenance contract from fix(acp): wake agents from workflow messages block/buzz#6953 onto the deployed fork
• have the relay attach canonical buzz:workflow-owner provenance and authority-bearing buzz:workflow-mention tags only for agent mentions present in the stored, unrendered workflow step template
• have both normal and setup ACP listeners fail closed unless the event is a valid kind 9 message signed by the trusted NIP-11 relay identity and the receiving agent was explicitly named by that stored template
• remove legacy actor attribution from workflow messages

This is intentionally limited to the paired relay and ACP authorization fix. It does not absorb the fork's large unrelated divergence from upstream.

Security properties

• forged signers, wrong kinds, invalid signatures, missing NIP-11 identity, duplicate tags, malformed values, legacy actor tags, and trigger-injected mentions fail closed
• existing owner-only, allowlist, DM, and respond-to=nobody policy checks remain downstream of the authenticated author resolution
• the executor derives authority-bearing mentions from the durable stored workflow definition, not from rendered trigger input

Verification

• env -u BUZZ_ACP_LAZY_POOL cargo test -p buzz-acp --lib (707 passed)
• env -u BUZZ_ACP_LAZY_POOL cargo test -p buzz-workflow --lib (159 passed, 5 integration-only ignored)
• env -u BUZZ_ACP_LAZY_POOL cargo test -p buzz-relay --lib workflow_sink (20 passed, 1 integration-only ignored)
• cargo fmt --all -- --check
• cargo clippy -p buzz-acp -p buzz-workflow -p buzz-relay --all-targets -- -D warnings
• full env -u BUZZ_ACP_LAZY_POOL just ci passed, including workspace Rust, Desktop, web, and all 1,162 mobile tests

Rollout boundary

Relay and Desktop ACP must be deployed as a pair. Production deployment and end-to-end verification follow only after this PR is green.

Originating Buzz channel: 7ce21003-c460-4384-a3f3-a95c3623bfe1
Originating thread: 87433f24cf3521e0cdd93741ddf4f7eb82c38d554b0c19a69261f65f1c10948c