fix(desktop): authorize external channel-member mentions

[reinhold-ph]

Why

External Gateway agents can be authoritative channel members and invocable by the current user while stale kind-10100 channel_ids still exclude the channel. Desktop then hides the agent from @ autocomplete, creating a circular dependency: the owner has already added the exact pubkey, but cannot structurally address it until someone manually republishes directory metadata.

Architecture

• Use the authoritative channel roster as additional channel-scoped eligibility evidence for relay/external agents.
• Keep directory invocation policy, owner authority, allowlists, respondTo, exact pubkey identity, and nonmember exclusions intact.
• Refetch membership at send time and fail closed when the fresh roster is missing, errored, refetching, or no longer contains the selected agent.
• Preserve canonical visible mention text and exact p tagging.

Membership supplements stale directory channel metadata; it does not bypass authorization.

Verification

• 4,795/4,795 Desktop unit tests passed.
• 38 focused external-agent eligibility and send-time revalidation tests passed.
• Two focused Playwright mention cases passed, including canonical p tags and removal after selection.
• TypeScript, E2E build, Biome, and git diff --check passed.
• Independently reviewed and approved after fresh-refetch/fail-closed corrections.
• Native isolated macOS candidate accepted:
  • Reinhold and Habeler both appeared in fresh-channel autocomplete;
  • selection emitted exact canonical p tags;
  • Habeler received and replied six seconds later.
• Paired Hermes runtime acceptance produced an exact-pubkey Reinhold reply in the same acceptance channel.

Cross-repository dependency

• fix(buzz): complete dynamic external-agent channel lifecycle hermes-agent#10 — dynamic membership reconciliation, subscriptions, reconnect state, replay floors, and directory publication.
• Buzz: dynamically publish directory metadata and subscribe after channel membership changes hermes-agent#6 — Hermes lifecycle tracker.
• External agents: channel add must enable immediate @mention without directory republish #14 — downstream integration tracker.

Related work

This does not overlap block#5856, which publishes ACP harness routing profiles. This PR addresses Desktop eligibility and fresh send-time authorization for external/native Gateway agents.

Base topology

integration/block-main-20260814 is a ref-only mirror of the exact block/buzz main commit (df9e773a13f17a270fd6531fc74948b8059d58c3) used for implementation and acceptance. The product range is one commit and six files. It is deliberately separate from the fork-sync/release gate; no commit was rewritten and no duplicate build was run for this ref topology.

Direct upstream PR creation was attempted but the reinhold-ph token is not authorized to create pull requests in block/buzz. The branch remains suitable for an upstream PR from the Peakhunter fork when an authorized GitHub identity submits it.

Scope

No relay membership weakening, no managed-agent identity changes, no cache surgery, and no manual directory publication path.