fix(acp): persist accepted work across restarts

[jketchell]

Problem

buzz-acp acknowledges accepted events with the eyes reaction, but its queue is process-local. A service restart after acknowledgement and before dispatch silently loses the request because the relay subscription watermark resumes from the new process start.

Fix

• Journal accepted queue-mode events atomically before returning acceptance.
• Restore unfinished events in original acceptance order on startup.
• Keep the journal entry while work is queued, in flight, cancelled/merged, or retrying.
• Remove entries only after success or a terminal user-visible failure/drop.
• Refuse acknowledgement if the durable write fails, preventing a false eyes marker.
• Restore the visible eyes marker for recovered requests.
• Use a per-agent state file under $HOME/.local/state/buzz-acp, with a BUZZ_ACP_PENDING_STORE override.

Verification

• cargo fmt --check -p buzz-acp
• cargo check -p buzz-acp
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo test -p buzz-acp queue:: (113 passed)
• Focused journal round-trip/removal test passed.
• Focused queue destruction/recreation recovery test passed.
• just ci completed workspace Rust formatting/clippy and desktop frontend checks; it was stopped during the unrelated desktop Tauri dependency-resolution phase after that cargo process remained idle.

Live proof

The exact patched Linux binary was built from current upstream main, hash-verified, installed on the hosted Buzz VPS, and the Codex service restarted cleanly and reconnected. The previous binary is retained as a rollback copy.