feat(mentions): add channel-wide @all mentions

[TelosSteward]

Summary

Add a reserved, case-insensitive @all token for channel messages. It expands at send time into explicit signed p tags for every current channel member except the sender.

• resolve membership from a fresh relay query, with no stale-cache fallback;
• merge and deduplicate ordinary named mentions, explicit pubkey mentions, and expanded recipients;
• reject the send atomically when the final unique set exceeds the existing 50-recipient mention cap, reporting the exact count;
• preserve the full Desktop draft on membership-query and cap failures;
• add the reserved token to Desktop autocomplete for stream and forum channels, while keeping DMs excluded; current Desktop forum sending may still reject the send independently, so forum delivery is covered at the Tauri/CLI layer rather than claimed as Desktop end-to-end support;
• suppress expansion inside inline and fenced code regions;
• keep edits and workflow-originated messages unchanged: literal @all does not mass-notify there.

This is deliberately a focused client-side fan-out change. It adds no event kind, relay schema, protocol marker, or deployment dependency.

Related issue

Addresses #5862 and #4970.

Related competing design: #3197 implements humans-only @channel / @here through a relay-recognized marker rather than per-recipient p tags. This PR serves a narrower but distinct use case: explicit opt-in wake-up of every current member, including agents, using existing mention delivery semantics. The tradeoff is intentional and bounded by the existing 50-recipient cap.

The token name is also an explicit point of difference: #5862 asks for @everyone, #4970 proposes @everyone or @channel, and #3197 uses @channel / @here. This implementation uses @all because it is short and names the agent-inclusive behavior without colliding with #3197's humans-only semantics. That vocabulary is not presumed canonical; a maintainer-requested rename is welcome, but it would be a reviewed follow-up code change rather than a silent textual substitution.

Testing

Evidence floor: mention semantics and Desktop transport were independently reviewed with mutation sensitivity proven. Full CI and isolated-relay runs were executed by the authoring agent rather than independently replayed. Two unrelated upstream-owned flakes required clean reruns and are disclosed below.

• cargo test -p buzz-sdk: 266 passed
• cargo test -p buzz-cli: 353 passed
• Desktop unit suite: 4,957 passed
• Desktop Rust/Tauri: 2,444 passed, 15 ignored
• full mentions.spec.ts: 70 passed
• full just ci: exit 0, including 1,465 mobile tests
• shared nine-row detection corpus is consumed by both Rust semantics and the TypeScript transport sentinel
• mutation controls proved the code-mask detector, recipient cap, and case-insensitive transport probes fail on known-bad candidates
• isolated current-main relay produced a valid signed event with exactly the other three members tagged and the sender excluded
• second-client membership mutation was reflected by the next send-time roster query
• a 52-member roster failed explicitly at 51 recipients and emitted no event
• relay-unreachable membership resolution failed without cache fallback and emitted no event

Two first runs were not green and are preserved rather than hidden by the final totals:

1. The mentions browser file first completed 69/70 because the upstream relay-agent revalidation case timed out observing its outgoing event. The isolated case then passed and the unchanged full file passed 70/70.
2. The first full CI run hit the pre-existing stochastic EFF-wordlist separator collision when the generated word yo-yo was split using -. The isolated test passed and the exact unchanged candidate then completed full CI.

No product code was changed in response to either flake.

Behavioral and privacy boundaries

• Every expanded recipient is visible as a signed p tag; this is provenance and delivery data, not a private roster mechanism.
• Every addressed managed agent may wake. That is the feature's explicit purpose, unlike the humans-only design in feat: @channel and @here channel-wide mentions (NIP-CM) #3197, and it creates a bounded but material amplification risk: one message can initiate as many as 50 recipient invocations.
• There is no recursion guard, per-sender group-mention throttle, or turn budget in this patch. A woken agent that replies with @all can trigger another fan-out, and several such replies can form a feedback loop. The 50-recipient cap bounds one event but is not sufficient mitigation for repeated events. If maintainers accept agent-inclusive group addressing, a follow-up recursion/turn-budget control is expected before broad deployment; the alternative is to adopt feat: @channel and @here channel-wide mentions (NIP-CM) #3197's humans-only boundary instead.
• The token is unavailable offline because a stale roster could silently omit current members; failure is non-destructive.
• A display name that case-folds to all cannot shadow the reserved token. That person remains addressable through an explicit pubkey mention.
• The cap is applied to the final deduplicated recipient set, so the implementation never truncates silently or emits a partial event.

[themiguelamador]

I found four correctness/safety issues and fixed them on Complear/buzz:review/pr-6050-fix (b4d3e724d).

1. P1 — the documented agent feedback loop is directly reachable through both official agent send paths. A managed agent could reply with literal @all; Desktop's managed-agent command and the injected buzz CLI would expand it to every member, wake other agents, and allow repeated 50-recipient fan-out with no turn or recursion bound. The per-event cap does not bound that loop. The fix reserves expansion for human identities: NIP-OA/delegated CLI identities and the managed-agent Tauri command reject active @all while still allowing literal code examples and explicit targeted mentions. The embedded agent guidance now states that boundary.

2. P1 — common Markdown code spans can accidentally mass-notify. strip_code_regions only understood a single-backtick inline delimiter. Standard double-backtick spans such as ``@all`` left the token visible to the detector and expanded it to the room. The shared scanner now consumes matching backtick runs, and the cross-language fixture covers the regression.

3. P2 — sentence-final @all. is not recognized. Generic mention tokenization treats . as a display-name character, so a normal sentence ending in the reserved token silently sends no group mentions. The fix adds reserved-token boundary handling that accepts trailing sentence punctuation while keeping longer dotted identities such as @all.team distinct, and aligns CLI name filtering with the same rule.

4. P2 — CLI applies the mention cap before the promised final-set normalization. Fifty-one explicit values including the sender were rejected even though sender exclusion leaves exactly 50 recipients. The @all path now defers its cap until after normalization, deduplication, roster merge, and sender exclusion; ordinary mention sends retain their existing early limit.

Please also remove the PR body's references to the “authoring agent”; this repository does not attribute assistant-generated work in PR metadata.

Validation on the fix branch:

• complete buzz-sdk suite: 266 passed
• complete buzz-cli suite: 355 passed
• strict SDK/CLI Clippy: passed
• focused Desktop transport/candidate tests: 7 passed
• Desktop TypeScript typecheck and policy/file-size checks: passed (only unrelated existing warnings/infos)
• Rust/Tauri formatting and git diff --check: passed
• focused native Tauri retry: environment-blocked before project test execution because sherpa-onnx-sys timed out downloading its upstream archive twice; the source PR's reported 2,444-test Tauri run remains the available baseline

The source branch was still at 77b22c3c2131f67fb8a467df8926ce30a3604ad1 immediately before this review.