feat(git): add default-branch management to relay and CLI

[wesbillman]

Authored by Brain and opened on behalf of Wes (wesbillman).

Summary

Add buzz repos default-branch get/set and the relay operation it needs. Git push changes branch tips but cannot select the server's symbolic HEAD. This selects an existing branch without deleting branches, moving refs, or changing packs.

• Reuse immutable Git manifests and captured-ETag CAS; concurrent pushes/default changes conflict, including stale no-ops.
• Require request-specific NIP-98, body binding, fail-closed replay protection, host tenancy, current channel membership and repository-management authority. Push/project roles alone are insufficient.
• Send the CLI mutation once, without redirects; ambiguous delivery retains the observed digest and is non-retryable.
• Document the narrow HTTP exception to Nostr-first, delegation scope and admission-time ACL revocation. Kind:30618 remains derived; the manifest CAS is authoritative.
• Register the Postgres/Redis/MinIO route and fresh-clone tests in the existing Backend Integration lane.

Review fixes — 7457bda50afa6b52e36315572fa96928b2e21db6

• Reject signed valueless payload tags when verifying a body; preserve the shared verifier's intentional absent-payload compatibility. The real settings route now proves 401, unchanged manifest pointer, and unchanged kind:30618 event IDs for malformed and other invalid credentials.
• Require a nonempty returned branch and head == refs/heads/{branch}; SET additionally requires the returned branch to equal the attempted branch. Malformed/mismatched mutation responses remain non-retryable DeliveryUnknown, retaining the attempted branch and original digest. Invalid reads fail before any POST.
• Strengthen the later-push/fresh-clone regression to select release/v1 while main exists.

Verification

At 7457bda50afa6b52e36315572fa96928b2e21db6:

• Full pre-push passed (all 14 Rust test groups, serialized Tauri tests/clippy, file-size and branch-skew gates; 522 seconds). No hooks disabled.
• All four isolated Postgres/Redis/MinIO settings tests pass, including real Smart HTTP ls-remote --symref and fresh clone on release/v1.
• All 15 focused NIP-98 verifier tests and three default-branch CLI tests pass; malformed credentials and missing-branch responses were reproduced failing before the fixes.
• Five targeted mutants are killed: restoring the valueless-payload bypass, weakening canonical HEAD validation, accepting an empty branch, dropping requested-branch confirmation, and omitting hydrated HEAD for the selected non-main branch. Mutations ran in a separate worktree and target directory; original patch bytes were verified restored.
• cargo clippy -p buzz-auth -p buzz-cli -p buzz-relay --all-targets -- -D warnings, formatting, diff and file-size checks pass on the fixed tree.

Earlier validation at bb195b140: seven Git authorization database regressions and 28 existing transport tests passed (three infrastructure cases in that module not selected); four mutations killed management/replay/CAS/redirect regressions. Full pre-push passed with RUST_TEST_THREADS=1 (all 14 Rust groups, Tauri clippy and 3,173 tests, size/branch-skew gates). Serial execution avoids an unrelated process-global Desktop discovery counter flake; no hooks disabled or Desktop changes.

Carl and Jude's review findings are addressed in the new head; fresh reviewer and exact-head security confirmation remain required. The earlier source review is not approval of this revision. No claim of green new-head CI.

Rollout

Merge and deploy the relay support first, then build/use the updated CLI and explicitly set/verify the desired default. No schema migration. This PR does not deploy anything or change a live repository.

Originating conversation (channel 8e2fda80-9142-4df8-8e14-da288bea6471):
buzz://message?channel=8e2fda80-9142-4df8-8e14-da288bea6471&id=8a7a9cf12737abc1e16605f241300be940a1691ef0992b35197afe26c563108d