Harden managed agent liveness and response visibility

[charlie-hermes]

Summary

• Align ACP presence refresh with the shared 30-second heartbeat and 90-second relay lease.
• Add owner-encrypted managed-agent runtime leases with ordered observer frames and stale-to-Unknown behavior.
• Track accepted mentions through the first relay-accepted visible reply and surface on-time, breached, or unknown outcomes.

Root cause

ACP refreshed presence every 60 seconds while the relay lease expired after 90 seconds. One dropped refresh therefore created a deterministic false-offline interval. Existing public presence also could not distinguish verified shutdown from crash or transport uncertainty, and there was no mention-to-visible-reply SLA correlation.

Validation

• cargo test -p buzz-acp --lib — 619 passed.
• cargo test -p buzz-core -p buzz-pubsub — 254 passed; 11 Redis-only tests ignored.
• cargo clippy -p buzz-acp -p buzz-core -p buzz-pubsub --all-targets -- -D warnings — passed.
• pnpm check, pnpm typecheck, pnpm test in desktop/ — passed; 3,640 tests.
• Root Rust formatting and Desktop Tauri formatting checks — passed.
• Full Tauri unit compilation is not available on the managed verification VM because its GLib/GObject/WebKit development packages are absent and sudo is disabled.

Safety

No production service, machine API, deployment, or unrelated branch was changed. This PR remains draft pending Aegis independent review.