feat(workflow): let workflows add reactions to messages

[BradGroux]

Note: This is a replacement for PR #2494, which was accidentally closed when branches were force-pushed after a commit identity rewrite. The changes are identical, rebased onto the latest main.

Fixes #2395.

What changes

Workflow add_reaction actions now publish a signed kind-7 reaction against the triggering message through the existing relay event path.

The reaction includes:

• the target event e tag;
• the target event kind k tag;
• the target author's p tag required by NIP-25 clients and Buzz's author-targeted push subscription;
• the workflow owner as the signer.

The sink resolves the effective target author through the same attribution helper used by ingest, so reactions to agent-authored messages target the actual author rather than a relay signer. Duplicate execution remains idempotent. The relay-backed regression now subscribes to the reaction by its actual kind-7 and e-tag shape, while the follow-up message retains its channel-scoped filter.

Safety and scope

• No public reaction REST endpoint is added.
• Desktop and mobile rendering are unchanged.
• Manual workflow triggers still cannot use add_reaction because they have no triggering message ID.
• Custom emoji metadata remains limited to the action's existing reaction-content field.

Verification

• cargo fmt --all -- --check
• cargo clippy -p buzz-workflow -p buzz-relay -p buzz-test-client --all-targets --all-features -- -D warnings
• cargo test -p buzz-workflow -p buzz-relay -p buzz-test-client --no-fail-fast: workflow and test-client suites passed; the unprovisioned relay run reached only the existing database-dependent failures.
• cargo test -p buzz-relay workflow_sink::integration_tests::workflow_add_reaction_persists_attributed_kind_7_and_dedupes -- --ignored --nocapture: passed against PostgreSQL and Redis.
• just test: all nine unit/package/database stages passed. The workspace integration stage reproduced the unrelated buzz-agent timing failure steer_folds_into_active_turn_without_cancelling; that test passes in isolation, and this branch does not modify buzz-agent.

This refresh is not production deployment evidence.

[BradGroux]

This is a replacement for #2494, which was accidentally closed when branches were force-pushed after a commit identity rewrite. Prior review comments and feedback are preserved on the old PR:

#2494