feat(cli): expose verified reaction events

[BeelixGit]

Summary

• add buzz reactions get --event <id> --events while preserving the aggregate response by default
• add global --format raw support for messages get, returning original complete signed relay event objects
• preserve normalized JSON behavior for existing consumers
• fail closed on malformed HTTP-200 bodies and incomplete, forged, mismatched-ID, or invalid-signature events
• preserve deterministic ordering, including timestamp ties

Security invariants

• deserialize cloned raw rows as canonical nostr::Event values
• verify NIP-01 event IDs and BIP-340 signatures with Event::verify() before output
• serialize the original relay JSON values after verification so extension fields survive
• retain the existing authenticated BuzzClient query path with no credential handling changes
• reject raw format on unsupported commands with usage exit code 1

Downstream contracts

Inbox reactions

buzz reactions get --event "$EVENT_ID" --events emits complete signed kind-7 events in deterministic (created_at ASC, id ASC) order. Inbox can apply first-wins deterministically and use the reaction event ID as its idempotency receipt.

Watcher / Launchwatch / Watchlist message recovery

buzz --format raw messages get --channel "$CHANNEL_ID" ... emits the original complete signed message event objects, including id, pubkey, created_at, kind, tags, content, and sig. Consumers can require verified publisher, channel, and thread markers without trusting normalized caller-controlled fields.

Compatibility

• reaction aggregate output remains unchanged without --events
• normalized message JSON remains unchanged and still omits signatures
• raw output is limited to the message read path

Tests

• cargo test -p buzz-cli: 290 passed
• cargo clippy -p buzz-cli --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check
• regressions cover empty objects, missing signatures, malformed schema, mismatched IDs, invalid signatures, malformed success JSON, raw-format command scoping, normalized compatibility, relay extension preservation, and deterministic equal-timestamp ordering

Review note

The raw-message verification change was independently reviewed after remediation. The final signed-off head is 921188ab5399f8fc17ffff39f95d533a078925ab. DCO, Semgrep OSS, and zizmor are green.

[BeelixGit]

Maintainer review gate receipt:

• External workflows are ACTION_REQUIRED: CI, Docker image, and Desktop Release Candidate. DCO, Semgrep OSS, and zizmor pass.
• Security: every returned reaction is deserialized as a complete signed nostr::Event, then its ID preimage and Schnorr signature are verified before aggregate or --events output. Incomplete, forged, tampered, bad-signature, wrong-kind, and wrong-target rows fail closed.
• Local gates pass: cargo fmt --all -- --check, cargo test -p buzz-cli --lib with 281 passed, cargo clippy -p buzz-cli --all-targets -- -D warnings, and git diff --check.
• Inbox dependency: buzz reactions get --event "$EVENT_ID" --events is globally paginated and sorted by (created_at ASC, id ASC). Inbox can use the first event deterministically and retain its exact reaction event ID as the idempotency receipt.

CODEOWNERS maps this PR to @block/buzz-oss-team. GitHub does not permit the external PR author to request that team directly. Maintainer action is to approve the external workflow runs and assign or complete the code-owner review.

[BeelixGit]

@tlongwell-block, when you have time, could you review this CLI contract? The PR now covers both verified reaction events and verified raw message events needed by downstream agent integrations. The body and test receipts are current at signed-off head 921188ab5399f8fc17ffff39f95d533a078925ab.