fix(desktop): enforce owner-only access in internal builds

[brow]

Problem

A provider-backed managed agent can still execute through local infrastructure, so backend type is not a safe authorization boundary. Internal Buzz builds need one effective access rule across local and provider-backed agents, while OSS builds must remain configurable.

Stored and relay-advertised access are deliberately not authoritative for this policy. A relay reader may still see a wider value such as anyone; runtime enforcement must clamp it at the point of actuation instead.

Changes

desktop/src-tauri/src/managed_agents/

• Apply the compiled owner-only policy when configuring a local child process.
• Reserve and set the local-spawn permitted-modes guard so the harness cannot widen access at startup.
• Keep stored and summary access unchanged. The permitted-modes startup guard is local-spawn only.

desktop/src-tauri/src/commands/

• Apply the same compiled policy when building provider deployment payloads.
• Route production deployments through the current-build policy wrapper so the compiled policy cannot be bypassed by the deployment path.
• Keep provider payload compliance beyond Desktop's handoff as a provider-harness trust boundary.

desktop/src/features/agents/, desktop/src/features/channels/, and desktop/src/features/onboarding/

• Keep the access control visible in internal builds, but lock it to owner-only with an explanation.
• Treat owner-only access as expected for both local and provider-backed Welcome teammates without masking unrelated restart requirements.

squareup/buzz-releases#74 supplies the internal-build marker in the shipped release pipeline. Until it lands, shipped activation is a fail-safe no-op.

Companion change: PR #4064 explains rejected non-owner messages in-thread.

Tests

Each production policy-wiring path has a dedicated regression that fails when its compiled-policy handoff is removed. Added coverage:

• current_build_deploy_payload_forwards_compiled_policy
• internal_policy_rejects_malformed_stored_allowlist_before_clamping
• internal_deploy_payload_clamps_stale_access
• internal_policy_overrides_stale_anyone_record_at_runtime
• reserved_keys_include_respond_to_gate
• internal_enforcement_clamps_local_and_provider
• internal local Welcome teammates accept enforced owner-only access
• internal provider Welcome teammates accept enforced owner-only access
• internal running local and provider teammates do not restart for enforced owner-only access
• internal running teammates still restart for runtime changes

Playwright E2E was not run.

Quality gates at tip e0165f52b52741a74184c9899e2b51eeec40c939

• Desktop Rust, OSS build: 2,093 passed, 0 failed, 15 ignored.
• Desktop Rust, internal build: 2,093 passed, 0 failed, 15 ignored.
• Desktop JavaScript: 3,910 passed, 0 failed across 61 suites.
• TypeScript, the desktop check bundle, Rust formatting, clippy with warnings denied, and the file-size ratchet passed.
• The dual-mode CI recipe ran the full Rust library suite in both build configurations and passed.

---

Originated from Buzz channel buzz-agent-control. Supersedes #2537.