feat(reports): add result-first thread reporting

[contentscoin]

Summary

• add signed, thread-rooted kind:40009 work reports and buzz messages report publish/update support
• validate channel scope, membership, status, payload limits, and prior head conflicts
• render the latest valid report as a Result Card above the preserved thread conversation
• show report author, status, outcome, deliverables, decisions, verification, risks, and next actions
• teach ACP agents to publish representative terminal/review outcomes without converting ordinary conversation into reports
• restrict canonical multi-agent report updates to explicitly named coordinators

Why

Long agent threads currently expose raw conversation but no canonical answer to what changed, how it was verified, or who acts next. This change introduces the signed report contract, its CLI/agent publishing path, and the result-first Desktop presentation as one complete vertical feature while retaining the transcript as evidence.

Verification

• repaired onto current upstream main with six DCO-signed commits; no unsigned merge commits remain
• fork CI run 33351624316 completed successfully at HEAD 00e1967
• Rust fmt/clippy/unit, Windows Rust, musl cross-compiles, Desktop Core/macOS, Desktop Smoke and Integration E2E, relay/backend E2E, and security passed
• Result Card reducer unit tests, TypeScript typecheck, production build, and Playwright flow passed in the component PR validation
• independent reviews of the report contract, Result Card, and agent-reporting prompt passed; requested fixes are included
• upstream DCO, Semgrep OSS, zizmor, and Security Review passed

Compatibility

Existing threads and messages are not migrated or deleted. A Result Card appears only when a valid work-report event exists for that thread; the original conversation remains available.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is c3132c3ee982d194cd0198ad07b57ec8bd726e4e...00e196793026477dd23c0ac5a8789f1dedbf1317.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 00e196793026477dd23c0ac5a8789f1dedbf1317 to authorize a new review.
Any previous review applies only to its recorded range.

[contentscoin]

Maintainer review requested. The report contract and CLI are now at d4f3d59. Fork CI run 33319896636 completed successfully across Rust lint/unit tests, Windows Rust, both musl targets, Desktop Core/Smoke/Integration E2E, relay E2E, backend integration, macOS build, and security. An independent line review found no blockers; three documented follow-ups are relay-side conflict handling, pagination beyond 100 reports, and accepting non-empty NIP-10 relay hints.

[contentscoin]

Closing this upstream contribution because the deployment target was clarified as contentscoin/buzz. The combined, fully validated change was merged as contentscoin#6 (merge commit 5bbf0b6).