feat(git-relay): add deterministic Rust core

[billy-armstrong]

Important

Draft: upstream product direction is still undecided. R2 wiring is paused. This PR is a reviewable R1 safety core, not a request to ship an unconsumed feature as-is.

Summary

• Add buzz-git-relay, a deterministic Rust reconciliation core with one public Reconciler::reconcile(...) interface.
• Port the validated TypeScript prototype behavior into typed Rust domain values, closed ports, guarded exact-ref apply ordering, replay safety, and truthful mutation evidence.
• Register the crate's tests in both enforced just test-unit paths.
• Document the 57-test parity/race matrix and keep R1 free of relay, database, GitHub, Nostr, scheduler, CLI, Desktop, deployment, and live-repository wiring.

Product decision requested before R2

No matching public issue or duplicate Git-relay PR was found. Before adding a consumer, we want maintainer direction on whether Git-relay should be:

1. a staged native core,
2. a smaller native core submitted with an observe-only consumer, or
3. an external companion service.

Until that direction is agreed, this PR remains draft and R2 is paused.

Safety and scope

• GitHub main remains canonical; only a proven behind ref can reach the exact-ref push port.
• Validated IDs, commit SHAs, approval events, and the managed ref enforce their invariants through deserialization as well as constructors.
• The final remote read checks both GitHub and Buzz immediately before the push seam; either side changing freezes without mutation.
• A successful post-push reread remains authoritative even if session close, lock release, or audit persistence later fails.
• github_target remains the approved requested target; an unapproved later GitHub read cannot replace it.
• Missing managed refs are never created.
• Immutable GitHub repository identity participates in replay matching.
• Any unverified failure after a push attempt reports mutation: unknown and omits an unverified after-SHA.
• Unlisted refs are preserved in disposable-real-Git proofs.
• Healthy reconciliation is deterministic and uses no LLM or model tokens.

Validation at 3388bd86815c001af2e799d75870cabccad8ff1c

• cargo test -p buzz-git-relay: 57 passed, including doctests.
• cargo clippy --workspace --all-targets -- -D warnings: passed.
• cargo fmt --all -- --check: passed.
• just test-unit: passed; both primary and fallback runners include buzz-git-relay.
• scripts/check-branch-skew.sh: passed; branch is rebased on a5dbdf5e61e4c512acd99c219c79c154ddb57295.
• Production scans found no unsafe, unwrap, expect, force/mirror/wildcard/delete refspecs in crates/buzz-git-relay/src.
• Independent standards and specification rereviews found no remaining high-confidence Phase A findings.
• Worktree clean at the exact commit.

Full repository CI caveat

Local just ci passed formatting, workspace Clippy, Desktop/Web checks and builds, Flutter analysis, all registered unit suites, and the Desktop Tauri suite. Its final mobile suite failed one test:

ChannelDetailPage keeps follow mode off while a tall newest message stays visible

That exact test also fails in isolation on unmodified upstream a5dbdf5e61e4c512acd99c219c79c154ddb57295; this PR has no mobile/ diff. The PR remains draft, and upstream merge-tree CI is still required before acceptance.

No deployment, live repository access, or relay mutation was performed.