feat(desktop): add persona event kind with client publish/read/retain

[wpfleger96]

Summary

Implements the foundation for the personas-as-events architecture (PR 1 of 2 in the post-852 roadmap). Defines a new Nostr event kind for persona definitions, adds client-side serialization, a local SQLite retention store for offline boot, and migrates existing personas.json entries to events.

Stack: this PR → #945

Changes

Relay side

• crates/buzz-core/src/kind.rs: Register KIND_PERSONA = 30175 as NIP-33 parameterized replaceable, keyed by (pubkey, kind, d_tag) where d_tag is the plaintext persona slug. Compile-time assertion verifies range membership.
• crates/buzz-relay/src/handlers/ingest.rs: Allowlist kind:30175 under Scope::UsersWrite, mark as global-only (never channel-scoped). New tests verify scope and global-only classification.

Desktop client side

• desktop/src-tauri/src/managed_agents/persona_events.rs (new): Serialize PersonaRecord ↔ kind:30175 event. JSON content body contains display_name, system_prompt, avatar_url, runtime, model, provider, name_pool, env_vars. Publish/fetch functions via relay HTTP API.
• desktop/src-tauri/src/managed_agents/retention.rs (new): SQLite retention store with INSERT OR REPLACE on (kind, pubkey, d_tag) for NIP-33 latest-wins semantics. Pending-sync queue for deferred relay publish. Enables offline boot when relay is unreachable.
• desktop/src-tauri/src/managed_agents/personas.rs: Add load_from_retention helper (wired up but not yet activated as the primary read path — that is PR 2 territory).
• desktop/src-tauri/src/migration.rs: migrate_personas_to_events runs after identity resolution, signs every retained event with the owner's real keys (no placeholder events). Idempotent via retention-row-exists check (the data is the sentinel). Core logic extracted into migrate_personas_in_dir for unit testing.
• desktop/src-tauri/src/lib.rs: Migration call moved after resolve_persisted_identity so keys are always available. Owner keys cloned from AppState and passed to migration.
• desktop/src-tauri/Cargo.toml: Add rusqlite dependency with bundled feature.

Key design decisions

1. d-tag: plaintext slug — personas are designed for discovery/sharing, not privacy. HMAC blinding is the wrong threat model (that is for private engrams).
2. Retention-first write strategy — write to local SQLite first (durable copy), then publish to relay opportunistically. Migration succeeds on local write, not relay ack.
3. Duplicate safety — INSERT OR REPLACE keyed on (kind, pubkey, d_tag) in SQLite. NIP-33 replaceable semantics handle relay-side idempotency.
4. Existing behavior unchanged — load_personas still reads from personas.json as before. The retention-based load path is a helper for PR 2 (instantiation flow).
5. No placeholder events — migration requires resolved keys (always available after identity resolution on desktop). Every retention row is a real signed event that downstream code can parse and verify.
6. Data-is-the-sentinel — idempotency keyed on whether the retention store already holds rows for the owner pubkey. No separate sentinel file needed.

Not in scope (PR 2 — #945)

• Instantiation flow (persona event → agent keypair → mem/persona engram)
• Fleet update (version diff propagation to instantiated agents)
• Removing bespoke file management code
• Activating retention store as the primary read path