Buzz for Devin v0.4.25-alpha.8

Buzz for Devin source alpha.8

This source alpha makes the agent harness choice explicit and fixes a newly disclosed dependency vulnerability before release.

Changed

• New users explicitly choose how runtime-default agents run during onboarding.
• The bundled Buzz Agent is offered alongside authenticated external harnesses, so Fizz, Honey, and Bumble do not have to consume a user's Devin account.
• Devin remains available as a first-class choice for agents that should use the official authenticated Devin CLI.
• Finish remains disabled until the selected bundled provider/model configuration is valid.
• Existing saved agent defaults are preserved; this release does not silently migrate current users.
• Updates both Rust lockfiles from nostr 0.44.5 to upstream-verified 0.44.6, resolving the malformed NIP-04 IV remote-denial-of-service advisory.

Validation

The release tree passed Security, Rust lint and unit tests, Windows Rust, macOS build, both Linux cross-compiles, all four desktop smoke shards, Relay E2E, Backend Integration, both desktop integration shards, and four multi-architecture Docker builds.

This remains a source alpha with a locally applied ad-hoc macOS signature. It does not redistribute a signed application bundle, modify Devin configuration, or inspect or copy Devin credentials. Follow the README installation command for the immutable alpha.8 tag.