fix(mobile): read fresh exact-key agent authorization

[loganj]

Summary

• Resolve requested agent keys from fresh signed profiles and exact owner policy coordinates; no runtime advertisement is required for an owned agent.
• Read NIP-11 self (not the contact pubkey) for signed relay membership, with exact-destination queries that include sender removals. Runtime claims cannot supply membership.
• Bound membership pagination with same-second cursors; propagate failed authority reads and stop subsequent queries on account/community scope changes. A newer invalid snapshot cannot revive an older permission.

Stack

Base: #7392 (fix/mobile-policy-20260905). Children: publication guard and owned-agent discovery. 502 added + deleted lines, tests included. Closest related PR: #7392.

Validation

• just mobile-check and the full just mobile-test passed on the source committed as 882f69cb (2,094 tests).
• Repository-wide just ci completed successfully (RESULT:0), including ACP 915/915 and final mobile 2,094/2,094. It began at b0a47693; the only source delta during the run was the mobile membership correction committed in 882f69cb, separately checked with full mobile analysis/tests and also covered by the final CI mobile run.
• Tests cover no-runtime ownership, ordinary owned membership role, forged membership, wrong destination, latest removal/invalid snapshot, deterministic ties, stalled pagination, scope changes, NIP-11 identity and authority failure.
• No native simulator available (no Xcode/simctl). This reader slice changes no layout.

Desktop reference: desktop/src-tauri/src/commands/agent_discovery/relay_directory.rs and commands/identity_archive.rs.
Originating Buzz channel: f6cfbbe2-3f94-4b41-9105-e6dcc5459813; request 9c1c48d4b47b390d88434d623d08c697275e7af9c20884715f44bf42b45c0edf.

Composed-stack evidence / landing note

Current review head: 882f69cbaf0f851717f071fba366b3b3a4a877d8; incremental size: 502 added + deleted lines.

All 11 draft slices are composed on verify/mobile-combined-20260905 at 40630565: just mobile-check and the full just mobile-test pass (2,144 tests). This is integration evidence, not a twelfth review PR or native-device acceptance.

Independent branches overlap, especially in the composer. Use that commit as the conflict-resolution reference when rebasing for landing; do not blindly choose one branch’s send function. Preserve exact/durable bindings, explicit Invite/reference-only intent, visit/account/community/revision fences, and authorization before membership preparation and before publication. Widened discovery must not roll out before #7390 + #7394 are integrated. Code dependency is only the declared PR base; overlapping files and rollout order are not extra dependency edges.

All PRs remain draft; no merge requested. Security/human review is not complete. Originating Buzz channel: f6cfbbe2-3f94-4b41-9105-e6dcc5459813.