feat(desktop): add protected owner attestation signer

[turningmagnets]

Owner-controlled source

This replaces the source branch used by #6687 with the exact independently reviewed head from Austen's own turningmagnets/buzz fork. No branch or asset from the earlier unidentified third-party fork is used by this PR.

• Reviewed head: c233e1845b4d4230ff425f53463c42624900d020
• Independent exact-head result: PASS, no blocking findings
• This PR does not merge, deploy, release, activate an agent, or publish an auth tag.

Summary

• add a bounded Desktop command that previews and signs one existing owner-attestation request using the active Desktop identity
• pass the request's conditions verbatim to buzz_sdk::nip_oa::compute_auth_tag; do not create an agent or publish to a relay
• write BUZZ_AUTH_TAG beside the request with descriptor-relative, no-replace, atomic 0600 custody; keep private key, signature, and tag value out of IPC
• expose the flow under Settings > App > Owner attestation with a final explicit confirmation
• harden confirmation rendering, canonical condition validation, post-confirmation identity/request revalidation, and one-use preview handling

Related issue

Closest related work: #5935 adds a CLI auth-tag command and #3807 explores external-agent authorization. This PR is intentionally narrower: it uses the already-loaded Desktop owner key, accepts the existing custody request shape, and returns no secret or tag value to the renderer.

Verification on the reviewed head

Passed:

• owner-attestation Rust harness: 22/22
• buzz-sdk: 301/301
• frontend tests: 5,802/5,802
• frontend contract tests: 3/3
• typecheck, formatting, Biome/policy checks, production build, and diff check
• secret scan

Environment-only gaps are explicit: the review host lacked the GTK/GLib development metadata required to compile the full Desktop Tauri crate, and no real GTK/macOS native-dialog smoke test was available.

Screenshot

The prior screenshot URL was intentionally not reused because it was hosted under the earlier unidentified third-party fork. A fresh screenshot can be attached from the owner-controlled branch without changing reviewed source bytes.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is c3132c3ee982d194cd0198ad07b57ec8bd726e4e...c233e1845b4d4230ff425f53463c42624900d020.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review c233e1845b4d4230ff425f53463c42624900d020 to authorize a new review.
Any previous review applies only to its recorded range.

[turningmagnets]

@block/buzz-oss-team Requesting maintainer review of this owner-controlled replacement PR. The exact independently reviewed head is c233e1845b4d4230ff425f53463c42624900d020. The security workflow requires a Block organization member to post this exact authorization line:

@buzz-security-review c233e1845b4d4230ff425f53463c42624900d020