feat(messages): add structured work reports

[contentscoin]

Summary

• add signed, thread-rooted kind:40009 work reports with a documented JSON contract
• enforce channel membership/scope, envelope, status, size, and list validation at relay ingest
• add buzz messages report with structured repeatable fields and prior head conflict checks
• cover SDK builder, relay validation, and CLI inventory/parsing contracts

Why

Long agent threads currently expose reply counts and raw conversation, but no canonical answer to what changed, how it was verified, or who acts next. This protocol is the data contract for a result-first card while retaining the transcript as signed evidence.

Verification

• cargo fmt --all -- --check
• git diff --check
• cargo check -p buzz-sdk -p buzz-cli -p buzz-relay attempted locally; dependency resolution completed, then compilation stopped before project crates because this Windows host lacks MSVC link.exe
• fork CI will provide the authoritative Rust compilation and repository-wide test result

Follow-up

Desktop consumption is intentionally a separate PR: latest-valid-report reducer, Result Card, and result/conversation/log progressive disclosure.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...d4f3d59ad02f4bf9f503acab2ff19abd1bd0200e.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review d4f3d59ad02f4bf9f503acab2ff19abd1bd0200e to authorize a new review.
Any previous review applies only to its recorded range.

[contentscoin]

Maintainer review requested. The report contract and CLI are now at d4f3d59. Fork CI run 33319896636 completed successfully across Rust lint/unit tests, Windows Rust, both musl targets, Desktop Core/Smoke/Integration E2E, relay E2E, backend integration, macOS build, and security. An independent line review found no blockers; three documented follow-ups are relay-side conflict handling, pagination beyond 100 reports, and accepting non-empty NIP-10 relay hints.