feat(issues): add opt-in graph task transitions

[contentscoin]

Summary

• add indexed depends-on tags to NIP-34 issue creation
• add issue-rooted kind:1 task transition operations with rom/ o/prior/gate tags
• add �uzz issues transition with graph-label opt-in, dependency resolution/cycle checks, trusted actor reduction, and stale-head protection
• order new operations after the latest transition from any signer so clock skew cannot place a valid causal successor before its head

Protocol decisions

• only kind 1631 (
  esolved) releases a dependency; kind 1632 (closed) remains blocking because it represents unresolved/not-planned work
• transition authorization intentionally uses the current assignee set, matching the approved v2 policy; removing an assignee may therefore remove their historical operations from a fresh reduction
• event IDs in prior are compared case-insensitively

Validation

• cargo fmt --all -- --check
• cargo metadata --no-deps --format-version 1
• git diff --check
• DCO, Semgrep OSS, and zizmor checks pass on the PR
• local cargo test -p buzz-sdk -p buzz-cli remains blocked before crate compilation because the Windows host lacks an operational linker; a fork PR CI run is being used for the compile/test gate

Scope

Desktop graph visualization remains Phase 3 and is intentionally excluded.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...67494c30890b7269305e6ab2678ad62b78a47f0d.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 67494c30890b7269305e6ab2678ad62b78a47f0d to authorize a new review.
Any previous review applies only to its recorded range.

[contentscoin]

Ready for maintainer review. The full Rust Lint and Unit Tests jobs pass on the fork CI at https://github.com/contentscoin/buzz/actions/runs/33310173835. Reviewer feedback is addressed in commits 97a2b53..67494c3. Protocol choices are intentional: only kind 1631 (resolved) unlocks a dependency; kind 1632 (closed/not planned) remains blocking, and transition authority is reduced against the current assignee set. All upstream-visible DCO, Semgrep, and zizmor checks are green.