fix: make Codex delivery resilient to sandbox DNS

[Greg-Moskalenko]

Summary

• keep Codex workspace-write turns network-enabled only when the adapter proves it honors Buzz's explicit network and writable-root policy
• add a harness-owned broker that transports the exact already-signed Buzz event when the sandboxed CLI has a degraded or ambiguous relay outcome
• verify relay acceptance and exact event readback for both direct and brokered delivery
• preserve message content, channel/thread tags, mentions, attachments, signer, and event id without reconstructing or re-signing the payload

Why

Kamaljinder's Luna turns continued to run and compose replies, but normal buzz messages send calls ran inside a Codex workspace-write sandbox whose per-turn policy disabled network access. Earlier sends only worked when the model happened to request an elevated retry. After a fresh session stopped choosing that escape, direct replies and heartbeat publications silently failed.

This change makes the intended workspace-write network policy explicit and adds a signed-event delivery contract outside the model sandbox so publishing no longer depends on model-selected escalation.

Safety properties

• direct relay delivery remains the primary path
• broker accepts only a bounded message-kind allowlist and validates signer, signature, event id, membership, channel tags, timestamps, size, capability, and request correlation
• broker publishes the exact signed event, performs exact readback, and never rebuilds or re-signs assistant prose
• bounded queue, scan, response, timeout, lease, symlink/reparse, and stale-file handling
• stock adapters fail closed at startup; the required adapter capability is versioned

Validation

• env -u BUZZ_ACP_LAZY_POOL ./bin/just ci
• full repository CI passed at 7626a21f89c7e35bf3e5e78e5e706f5abeb68e28
• release binaries built and SHA-256 pinned for live Luna acceptance
• independent security/correctness review completed with no remaining actionable findings

Dependency and merge gate

Paired adapter change: agentclientprotocol/codex-acp#368.

Do not merge this PR until the compatible adapter is available to the Buzz package/runtime. Live acceptance must also pass on Luna with a fresh session: one channel mention, one DM, and one forced material heartbeat, each accepted once and read back from the intended destination without require_escalated or EAI_NONAME.