fix(channels): preserve canonical member rosters

[Toos00]

Summary

• serialize kind 39002 member p tags in canonical pubkey order
• make buzz-admin reconcile-channels publish rosters through the locked member-snapshot path with a monotonic timestamp
• preserve relay self-tags when the relay signer is also a canonical channel member
• add regression coverage for large rosters, deterministic ordering, and relay self-membership

Why

nostr::EventBuilder removes signer self-tags by default. When buzz-admin reconcile-channels signs a roster with a relay key that is also a canonical channel member, the resulting event can omit that relay owner and fail the database roster fence with kind 39002 roster does not match canonical channel membership.

The relay path already uses allow_self_tagging() after #3777. This change brings the admin reconciliation path to parity and makes roster output deterministic.

Validation

• cargo fmt --check
• cargo test --locked -p buzz-relay group_members_snapshot_ -- --nocapture (3 passed)
• cargo test --locked -p buzz-admin --bin buzz-admin -- --nocapture (1 passed)

The Rust tests were run in rust:1.88-bookworm with pkg-config and libssl-dev, matching the projects documented Linux prerequisites.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 2af9773d6271ce62cbe5dfbd28fbe5dd79372465...48b7fa405cacd625a4f0befdd1d30e690bfe54fc.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 48b7fa405cacd625a4f0befdd1d30e690bfe54fc to authorize a new review.
Any previous review applies only to its recorded range.