feat(profiles): archive, unarchive and delete agents from the profile pane

[kalvinnchau]

Change

• Adds Archive, Unarchive and Delete to the agent profile pane. The copy follows base Buzz.
• Authority: the actions appear only when authority is verified: an ownership consent credential or a relay owner/admin role. A self-asserted profile claim does not count.
• Archive and Unarchive publish NIP-IA identity-archive requests. Before Archive can be confirmed, a fresh archive-state read must return the same result the request was expecting.
• Delete is available only to the verified owner of a single local native record. Deployed remote records get no Delete. Steps, in order:
  1. Remove the agent from every channel the viewer can discover (kind 9001). Each removal is confirmed by a fresh relay-signed roster read for that channel.
  2. Archive the identity and confirm it with a fresh read.
  3. Stop the local process, then remove the native record and the app-owned key.
  • A failure at any step leaves the record in place, so Delete can be retried.
  • Closing the profile stops any new removal, archive or native request from starting. Requests already sent still settle.
• agent_control_delete is granted to the main webview only. The native guard refuses to delete deployed remote records.
• Scope matches base Buzz:
  • Delete covers the channels the viewer can discover. Memberships in private channels the viewer can't see may remain.
  • Archive hides the identity; it does not revoke its access.
  • Deleting the key is best-effort. Shared and legacy keys are kept.
• The pending, failure and stale states are covered in docs/agents.md.

Verification

• pnpm check: pass.
• Full Vitest: 3741/3741.
• Node integration: 133/133.
• cargo test --workspace: 155 passed / 4 ignored.
• clippy -D warnings and cargo fmt --check: clean.
• Fixture regressions cover:
  • authorized and unauthorized paths;
  • the per-channel roster check, including the case where the roster can't be read;
  • a stale cached archive state;
  • hiding Delete for deployed remote records;
  • native-last ordering;
  • cancellation during the archive read and during outbox hydration.
• Not covered:
  • Delete in a live app talking to a real relay and native backend;
  • process stop and key deletion on a real OS keychain;
  • restart recovery.