fix: channel templates should not silently omit remote managed agents from the roster

[dschwartzAI]

Problem

A channel template can contain an agent roster expressed as Desktop persona/team IDs. When the intended agents are long-running provider/VPS identities rather than Desktop persona instances, buzz channels create --template still creates the channel and applies its metadata/canvas, but no matching member is added for those roster entries.

The command currently reports unresolved entries in skipped, but roster omission is not treated as an incomplete template application. In Desktop/operator use this looks like a successful template creation while the people/agents expected to receive mentions are absent. The failure is easy to miss and leaves workstream handoffs open.

This is distinct from #2728: groups would make bulk membership easier, but existing templates still need deterministic behavior when their saved roster cannot resolve.

Reproduction

1. Run a managed agent on a remote/VPS provider as a stable Nostr pubkey that is not represented by a local Desktop persona instance.
2. Save a channel template whose roster refers to the expected persona/team.
3. Create a channel with that template.
4. The channel, canvas, visibility, and description are applied, but the remote agent is absent. An unrecognized team ID fails loudly; an unresolved persona entry is only returned as skipped.

Expected

At least one of:

• support direct member/agent pubkeys in TemplateAgentRoster, so provider-backed identities can be rostered deterministically; or
• make unresolved requested roster entries an explicit incomplete/failure result requiring acknowledgement, rather than a successful template application.

The strongest flow is atomic from the operator perspective: create → resolve/add requested members → verify the resulting roster, with a machine-readable failure if any required member is missing.

Current safe workaround

Leave the template roster empty, apply its channel/canvas settings, then add the required pubkeys explicitly with buzz channels add-member and verify them with buzz channels members before declaring channel creation complete.

[iroiro147]

Fix up in PR #4093 (branch claude/issue3953-template-pubkeys-20260801).

Implemented the issue's option (a): a new agentPubkeys roster entry [{ pubkey, label? }] that bypasses the persona→kind:30177 resolution and adds the pubkey directly as a channel member — deterministic for provider/VPS-backed agent identities.

Behavior guarantees:

• direct passthrough to build_add_member; malformed/short pubkeys land in member_failures, never silently dropped, never in skipped
• readable fallback label pubkey:<first16> when label is omitted
• mix-and-match with existing personas/teams entries — a template can use all three

Regression guards added: parse rejection for malformed agentPubkeys entries (closing the silent-drop vector from the persona path), no-panic label-truncation for short strings, empty default on pre-#3953 templates.

Verification: cargo test -p buzz-cli --lib 276/276 green, clippy clean.