fix(desktop): complete client-only deletion recovery and discovery (follow-up to #7419)

[JackHunzicker]

Summary

Follow-up to #7419 (device-local agent hosting policy, @lechnertech-mike). This branch is #7419's head 76a1a6e40c3dd3c9c3018748aa1515d8b96ebe3a plus one additional commit; the original commits are untouched and this is offered as an increment on top of that work, not a replacement. Happy to have it pulled into #7419 directly (maintainer-can-modify is set on that PR) or reviewed here, whichever is easier.

It closes the gaps Codex flagged in the latest review round on #7419 (event_sync.rs:22 deletion recovery under selective sync, profile.rs:272 discovery after policy-load failure, personas/update.rs:175 rename duplicates) plus one adjacent hardening:

• Deletion recovery in unique-name mode. Recover an interrupted managed-agent deletion only for explicitly registered local identities with a verified owner-signed retained kind:30177 head. Strictly read and parse the live store before treating an identity as absent, reuse the existing atomic kind:5/kind:9035 deletion-and-archive transaction, and recover before publication. Retention and local registration are prepared before persona cascades remove their managed-agent records. Unregistered remote-only identities and exact preferred remote keys are never recovered (no cross-device deletion).
• Discovery after a malformed policy file. Hosting stays fail-closed, but read-only discovery (people search, mention autocomplete, recipient pickers, list_relay_agents, list_personas) works through an explicit client-only fallback. The fallback is not persisted over the invalid policy and stored activation state is not rewritten.
• Persona rename validation. Validate against the exact identities the update will rename, preserve pool-named instances, reject duplicate normalized names, and recheck against the fresh store under the lock before saving.
• Test seams. Exercise the real discovery commands and deletion publisher via loopback fixtures. The test-only /events receiver is registered in the exact-count egress inventory; no production guard or mutation detector is weakened.
• docs/agent-device-policy.md documents the recovery and discovery behavior.

The interrupted-deletion gap predates #7419; this is not a claim that #7419 introduced it. Team deletion is not broadened into managed-agent deletion.

Related issue

#7419, #5319, #6211.

Testing

• Native desktop library: 3,060 passed, 0 failed, 15 ignored (cargo test --manifest-path desktop/src-tauri/Cargo.toml --lib --locked).
• Desktop JS: 6,456 passed, 0 failed (pnpm test).
• pnpm build:e2e passed.
• Browser (Playwright smoke, tests/e2e/client-only-agents.spec.ts): 2 passed (client-only and unique-name modes keep a stable remote identity as the recipient).
• Rust fmt, git diff --check, just file-size-check pass.

Verified on Windows (x86_64-pc-windows-msvc). Full just ci on this host surfaced pre-existing Windows-only Clippy/test-fixture issues on main unrelated to this change; those are fixed locally and will go up as a separate PR to keep this scoped. Real two-device relay interoperability has not been exercised here; the native store tests and mock-bridge browser tests are the evidence.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...e4a880e129692879b583de14faec3295cec3bbc3.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review e4a880e129692879b583de14faec3295cec3bbc3 to authorize a new review.
Any previous review applies only to its recorded range.