feat(buzz-cli): support direct relay pubkeys in channel-template rosters

[iroiro147]

Problem

A channel template's agents roster previously only accepted Desktop persona ids (which resolve through kind:30176/30177 events) and team ids. Long-running remote or VPS-managed agent identities — stable Nostr pubkeys with no local Desktop persona instance — could not be deterministically rostered. They ended up in the report's skipped bucket with the channel otherwise created successfully, leaving the operator thinking the roster was applied when it wasn't (#3953).

Fix

This implements the issue's option (a): add a third roster variant agentPubkeys: [{ pubkey, label? }] that bypasses the persona→kind:30177 slug scan entirely and adds the pubkey directly as a channel member. Template authors now have a first-class deterministic path for provider-backed agent identities.

Three behavior guarantees:

1. Direct passthrough — the pubkey is passed verbatim to build_add_member. A malformed or short pubkey surfaces as a member_failures entry, never silently dropped, never in skipped.
2. Readable fallback labels — when label is omitted the template report uses the first 16 chars of the pubkey (pubkey:<16>) instead of dumping the full 64-hex.
3. Backward compatible — templates written before this field existed deserialize with agent_pubkeys: [] and behave exactly as before.

Code

• crates/buzz-cli/src/commands/channel_templates.rs — new TemplatePubkeyEntry { pubkey, label }; TemplateAgentRoster gains #[serde(default)] agent_pubkeys: Vec<TemplatePubkeyEntry> (camelCase JSON agentPubkeys).
• crates/buzz-cli/src/commands/channels.rs — new pure helper expand_direct_pubkeys converts the entries verbatim into ResolvedAgents; build_roster_resolution collects them alongside the existing persona/team slug scan and merges them into RosterResolution.agents before any channel creation.

Tests

New unit coverage in channels.rs:

• expand_direct_pubkeys_uses_label_when_present
• expand_direct_pubkeys_falls_back_to_truncated_pubkey_label — includes a short/malformed pubkey that must not panic and must truncate at its actual length
• expand_direct_pubkeys_empty_when_no_entries

New/extended coverage in channel_templates.rs:

• load_templates_parses_direct_agent_pubkeys — full camelCase JSON round-trip, optional label
• load_templates_rejects_invalid_pubkey_entry — malformed entry (missing pubkey) fails parse; the silent-omission regression vector from the persona path is closed
• load_templates_parses_full_roster — extended to assert agent_pubkeys defaults to empty on pre-fix: channel templates should not silently omit remote managed agents from the roster #3953 templates

Verification

cargo check  -p buzz-cli                              # OK
cargo test   -p buzz-cli --lib                        # 276 passed, 0 failed
cargo clippy -p buzz-cli --all-targets -- -D warnings # OK

Fixes #3953.