feat(workflow): let workflows add reactions to messages

[BradGroux]

Fixes #2395.

What changes

Workflow add_reaction actions now publish a signed kind-7 reaction against the triggering message through the existing relay event path.

The reaction includes:

• the target event e tag;
• the target event kind k tag;
• the target author's p tag required by NIP-25 clients and Buzz's author-targeted push subscription;
• the workflow owner as the signer.

The sink resolves the effective target author through the same attribution helper used by ingest, so reactions to agent-authored messages target the actual author rather than a relay signer. Duplicate execution remains idempotent. The relay-backed regression now subscribes to the reaction by its actual kind-7 and e-tag shape, while the follow-up message retains its channel-scoped filter.

Safety and scope

• No public reaction REST endpoint is added.
• Desktop and mobile rendering are unchanged.
• Manual workflow triggers still cannot use add_reaction because they have no triggering message ID.
• Custom emoji metadata remains limited to the action's existing reaction-content field.

Verification

• cargo fmt --all -- --check
• cargo clippy -p buzz-workflow -p buzz-relay -p buzz-test-client --all-targets --all-features -- -D warnings
• cargo test -p buzz-workflow -p buzz-relay -p buzz-test-client --no-fail-fast: workflow and test-client suites passed; the unprovisioned relay run reached only the existing database-dependent failures.
• cargo test -p buzz-relay workflow_sink::integration_tests::workflow_add_reaction_persists_attributed_kind_7_and_dedupes -- --ignored --nocapture: passed against PostgreSQL and Redis.
• just test: all nine unit/package/database stages passed. The workspace integration stage reproduced the unrelated buzz-agent timing failure steer_folds_into_active_turn_without_cancelling; that test passes in isolation, and this branch does not modify buzz-agent.

This refresh is not production deployment evidence.

[BradGroux]

I rebased this branch onto current main and checked the emitted reaction against the consumers that now exist there.

The feature is still relevant, but the old branch omitted the target author's NIP-25 p tag. That was not just metadata polish: Buzz's current author-targeted push subscription uses the p tag, so workflow reactions could be stored and rendered while failing to notify the target author.

Head d2c7a8343d03b94f799dec12c60a0e051becfdf5 resolves the effective author of the triggering event, adds the signed target-author p tag, and preserves the existing deduplication path. The regression now asserts the e, k, and p tags together.

The affected package suites, strict Clippy, and Rust formatting were refreshed. The non-database tests passed. Nine unrelated relay media/admin tests could not obtain this host's local PostgreSQL pool, and a serial rerun hit the same boundary. The new ignored PostgreSQL regression compiled, but I am not presenting the unavailable database run as passing evidence.

[BradGroux]

Rebased this branch onto current block/buzz main at c55e421a0.

Head moved from cad2b5364 to 7f905a532. git range-diff shows the add_reaction relay-sink patch is unchanged, and the branch now has a direct merge base with current main.

Verification:

• The full buzz-workflow suite passed: 153 tests passed and 2 remained explicitly ignored.
• All 17 relay workflow-sink tests passed; 1 Postgres-backed test remained explicitly ignored.
• The workflow-actions E2E target compiled and remained explicitly ignored because no relay service was running.
• git diff --check, DCO trailer checks, and the direct merge-base audit passed.

GitHub checks are rerunning on the new head.

[BradGroux]

Rebased onto current block/buzz main at b1b283cd4 and rechecked the branch against #2495 and #2634. #2494 remains the focused submission for #2395: #2495 bundles unrelated Desktop transport work, while #2634 explicitly excludes workflow reactions.

The rebase audit found one test defect rather than a production-path defect. The relay emits the kind-7 reaction with its target e tag but no channel h tag; the ignored E2E subscribed with both, so it could never observe the actual event when enabled. The regression now uses separate filters for the reaction's real event shape and the channel-scoped follow-up message.

Published head: 1a4f5bd833c417085ef2f6edff2e92047276d94d.

Verification passed for formatting, strict Clippy across the three affected packages, and the PostgreSQL/Redis-backed kind-7 persistence and deduplication regression. The repository just test gate passed nine stages before reproducing the unrelated buzz-agent timing failure steer_folds_into_active_turn_without_cancelling; that test passes in isolation, and this branch has no buzz-agent diff.