fix(desktop): recover tenant-scoped agent runtimes

[ugiya]

Summary

• preserve the canonical relay URL as managed-process identity while using the configured relay URL as the connection target
• scope runtime receipts, restore, reconciliation, status, and frontend caches to the agent/community pair
• fail closed when distinct configured communities collide on one canonical runtime identity
• validate receipt ownership and liveness before reuse, termination, or removal

Context

This carries forward the configured-relay work from #4859 by @anilkishan and addresses the outstanding review findings on that PR.

Buzz deliberately treats localhost, 127.0.0.1, and ::1 as distinct configured communities even when they canonicalize to the same local relay identity. The runtime therefore needs two concepts:

• canonical relay URL: process and snapshot identity
• configured relay URL: tenant and connection target

Collapsing those concepts can make one community appear live in another community and can let Stop, Restart, restore, or reconciliation act on the wrong process.

Fix

• Persist the configured connection target in runtime receipts and summaries.
• Make a valid live receipt's connection target authoritative for pair-scoped operations.
• Ignore dead, stale, malformed, or foreign receipts before selecting a process.
• Reject a valid live receipt whose target does not match before terminating or removing anything.
• Keep requested-target identity through restore and automatic reconciliation.
• Key frontend status, action, and reconciliation state by configured community rather than canonical identity alone.
• Treat canonical collisions as stopped for the current community instead of failing the complete runtime list.
• Reject pair-scoped operations when a live legacy scalar PID has no target receipt; agent-wide Stop remains the explicit migration path.
• Avoid including raw configured relay URLs in aggregated restart errors.

Connection-target comparison folds harmless URL spelling differences while preserving tenant-significant distinctions such as localhost versus 127.0.0.1.

Review

An independent xai/grok-4.6 xhigh review found one remaining legacy-PID safety gap. The pair-scoped scalar-PID conflict guard was added, focused regressions were expanded, and the follow-up review returned SOLID with no remaining findings.

Verification

Exact pushed head: 29a7fdb11

• just desktop-tauri-test: 2,458 passed, 15 ignored; all integration suites passed
• just desktop-tauri-clippy: passed with -D warnings
• just desktop-tauri-fmt-check: passed
• pnpm --dir desktop test: 4,960 passed
• pnpm --dir desktop typecheck: passed
• pnpm --dir desktop build: passed
• repository pre-push gates: branch skew, Desktop check/typecheck/tests, Rust tests, and Desktop Tauri checks all passed
• git diff --check origin/main...HEAD: passed

This PR is independent of #5980 and has no file overlap with it; either change can be reviewed and merged first.

[themiguelamador]

Found and fixed one fail-closed gap in the new connection-target comparator.

connection_target and its TypeScript mirror accepted any parseable URL and dropped userinfo/fragments while normalizing it. As a result, invalid relay descriptors such as wss://alice@relay.example and wss://bob@relay.example (or different fragments) could alias in frontend reconciliation/status cache keys instead of following the documented exact-string fallback; the Rust helper had the same contract mismatch. This matters here because the PR relies on connection-target identity to prevent one status/action row from claiming another.

Verified fix commit: dce21a6031f37fd71fa337934db5209cdaeaf62b (fix(desktop): reject invalid runtime connection targets). It rejects non-ws(s), credential-bearing, and fragment-bearing targets in both implementations and adds regressions for exact fallback.

Verification: 140 focused Tauri tests passed; all 4,960 Desktop tests passed; TypeScript typecheck, Biome, Rust fmt, Tauri clippy with -D warnings, and git diff --check passed.

I attempted to push the commit to ugiya/fix/tenant-scoped-agent-runtimes because maintainer edits are enabled, but GitHub returned 403 for themiguelamador.