feat: harden Context Engine agent delivery

[johnpein]

Summary

• add exact Gabe/Stacy Context Engine harness recognition with one-shot credential stdin and immutable runtime validation
• sandbox ordinary managed agents in private per-agent workspaces while preserving authenticated Git worktrees
• make the Stacy first-Save path select the reviewed frozen outer ACP binary
• add locked, rollback-safe runtime installation and stable-path reproducible ACP release builds
• tolerate later Gabe commits only when guarded shared-runtime bytes remain identical to Stacy upstream provenance

Validation

• just ci
• cargo test -p buzz-acp
• Desktop strict clippy, focused Context Engine and sandbox tests
• two cargo-clean trusted ACP builds produced SHA-256 f026d37b61cd9cc5dcc13cd59856301591dcddd7f81ad894680680218f99a97d
• adversarial security and end-to-end reviews found no remaining Critical, High, or Medium code defects

Release gate

Do not install an unsigned local build. Activation remains gated on a Block Developer-ID-signed and notarized Buzz artifact built from the exact upstream merge commit, followed by the single-Save Stacy DM proof.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 00e61eafa917d296104006576b7a2ddbfd58bb5a...67cb7f2c45f7c4d9103dce5bc3ade3ea34e1b5da.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 67cb7f2c45f7c4d9103dce5bc3ade3ea34e1b5da to authorize a new review.
Any previous review applies only to its recorded range.