fix(desktop): re-sign stale retention events at flush

[olympusbuildz]

Problem

Managed-agent retention can leave parameterized replaceables (kinds 30175–30178) and kind:5 tombstones stuck with pending_sync = 1 forever. Desktop re-publishes the retained pre-signed raw_event every ~30s; once created_at falls outside the relay ingest skew window the relay rejects every attempt and nothing ever clears.

Root cause

flush_pending_events_at in desktop/src-tauri/src/managed_agents/persona_events.rs replayed retained pre-signed events for most kinds.

Relay ingest enforces MAX_TIMESTAMP_DRIFT_SECS = 900. After that window:

• publish → invalid: event timestamp too far from server time
• row stays pending_sync = 1
• next flush repeats forever (reject storm)

NIP-IA identity-archive requests already re-signed with a fresh timestamp at publish; parameterized replaceables and tombstones did not.

Fix

At flush/publish time, re-sign events that need a fresh timestamp via the same path as archive requests (resign_with_fresh_timestamp):

• parameterized replaceables 30175–30178 (is_parameterized_replaceable)
• kind:5 tombstones
• existing archive-request path unchanged

Preserves kind, tags, and content. mark_synced still keys off the retained original created_at + content so local retention rows clear correctly after a successful publish.

Helper: needs_fresh_timestamp_at_publish.

Why it matters

Without this, managed-agent persona/retention traffic can permanently hammer the relay with undeliverable events and never converge — a reliability bug for every desktop that retains those kinds across the ±15m window (sleep, offline, long-lived agents).

Test plan

cd desktop/src-tauri   # after: just _ensure-sidecar-stubs from repo root
cargo test --lib flush_barrier -- --nocapture

• Unit coverage in persona_events/tests.rs (flush_barrier): fresh-timestamp re-sign for parameterized replaceables + kind:5; mark_synced keying unchanged
• DCO / Semgrep OSS / zizmor green on this PR
• Full monorepo just ci not run on 16GB Mini for this change (desktop Tauri lib filter only) — happy to run or expand if maintainers want
• Manual soak (optional): create managed agent, age/backdate a retained replaceable raw_event past 15m, confirm next 30s flush is accepted and pending_sync clears

Risk / blast radius

• In scope: desktop managed-agent retention flush publisher only
• Not changed: relay ingest rules, non-retained publish paths, replaceable semantics beyond fresh created_at at send
• Sync keying: intentionally still original created_at+content so we do not orphan retention rows after re-sign

Closest existing work

none found for this root cause (issue #4967 was open without a linked fix PR at open time)

Follow-ups

none deferred in-tree; optional maintainer ask: broader soak on long-lived BYOH desks

Fixes #4967