feat(desktop): instance-level agents nav with atomic workspace-scope capture

Add owner-consent archive/unarchive commands, workspace-epoch seqlock
protocol, NIP-IA ownership classifier, and Instances Sheet UI.

Rust (desktop/src-tauri):
- WorkspaceEpochWriteGuard (workspace_epoch.rs): RAII seqlock writer guard
  with SeqCst ordering, writer-mutex serialization, and guaranteed even
  restoration on every exit path including panic/unwind. All three production
  key writers (resolve_persisted_identity, commit_imported_identity,
  apply_workspace) participate; apply_workspace spans its compound
  override+keys mutation under one guard.
- AppState extended with workspace_epoch: AtomicU64 + workspace_write:
  Mutex<()> for the seqlock protocol.
- capture_archive_scope: bounded-retry reader that accepts only equal-and-even
  epoch samples, ensuring keys and relay_url_override come from one workspace
  generation.
- ArchiveScope { keys, actor, api_base_url, workspace_epoch }: immutable
  snapshot consumed by every fetch/classify/mint/sign/submit in the scoped
  archive operation.
- NipIaOwnerProof classifier: enum verified|missing_profile|missing_auth|
  multiple_auth_tags|invalid_auth|owner_mismatch. Reuses verify_auth_tag
  (syntax + signature only, no condition-clause evaluation per NIP-IA rule 6).
- scoped_archive_operation: single non-Tauri fn owning the full
  fetch→classify→mint→build/sign→submit pipeline for both 9035 (archive) and
  9036 (unarchive). Fresh empty-condition auth tag minted after Verified
  classification; never copies the profile tag.
- archive_agent / unarchive_agent: thin #[tauri::command] wrappers.
- Keyring helpers extracted to app_state_keyfile_ops.rs to stay under the
  file-size ratchet (app_state.rs: 998 gate lines, limit 1080).
- Relay acceptance tests (identity_archive/tests/identity_archive_relay_tests.rs):
  five #[ignore]d tests requiring live relay+Postgres, selected by the new
  desktop-tauri-relay-acceptance just recipe and the Backend Integration CI
  gate. Tenant fixture makes Self and Admin impossible; 9035 asserts
  consent_path='owner' in Postgres; 9036 asserts emitted delta.
- Deterministic epoch protocol tests (app_state_epoch_tests.rs): no infra,
  always-required in desktop-tauri-test/Desktop Core gate. Tests: initial
  capture, writer exclusion+capture retry, RAII restoration (drop/early-
  return/catch_unwind), poisoned-mutex error, mixed-generation barrier test.

TypeScript (desktop/src):
- tauriIdentityArchive.ts: archiveAgent/unarchiveAgent Tauri bindings.
- hooks.ts: useOwnedAgentInventoryQuery hook with additive cache invalidation.
- InstancesSheet.tsx: instances sheet opened from Instances (N) card action;
  shows tri-state archive status, start-control safeguard for 3rd instance.
- PersonaActionsMenu.tsx: onViewInstances prop wired to InstancesSheet.
- UnifiedAgentsSection.tsx: Instances button in agent card actions.
- relayQueryInvalidation.ts: ownedAgentInventoryQueryKey registration.

CI/Justfile:
- desktop-tauri-relay-acceptance just recipe: _ensure-sidecar-stubs +
  nextest selector for in-crate relay acceptance module.
- Backend Integration (relay e2e) job: new step just desktop-tauri-relay-
  acceptance after relay startup; job if extended to desktop-rust; Tauri Linux
  apt deps + rust-cache for desktop/src-tauri; timeout raised.

Thread: nostr:nevent1qqs0jp4fmfhaxcm7etlyq9csgwhg73j44f2akkhcnzfnk7s0w6rxptqpz24mxk
Plan: v9, APPROVE by Thufir (event 7dd99118), baseline 8342dfcc
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

.github/workflows/ci.yml

@@ -574,14 +574,43 @@ jobs:
   backend-integration:
     name: Backend Integration (relay e2e)
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 35
     needs: [changes, desktop-e2e-relay]
-    if: github.event_name == 'push' || needs.changes.outputs.rust == 'true'
+    if: github.event_name == 'push' || needs.changes.outputs.rust == 'true' || needs.changes.outputs.desktop-rust == 'true'
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+        with:
+          workspaces: desktop/src-tauri
+          save-if: ${{ github.event_name != 'pull_request' }}
+      - name: Install Tauri dependencies (Linux)
+        env:
+          DEBIAN_FRONTEND: noninteractive
+        run: |
+          sudo apt-get update \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30
+          sudo apt-get install -y --no-install-recommends \
+            -o Acquire::Retries=3 \
+            -o Acquire::http::Timeout=30 \
+            -o Acquire::https::Timeout=30 \
+            -o DPkg::Lock::Timeout=120 \
+            build-essential \
+            curl \
+            file \
+            libasound2-dev \
+            libayatana-appindicator3-dev \
+            libgtk-3-dev \
+            librsvg2-dev \
+            libssl-dev \
+            libwebkit2gtk-4.1-dev \
+            libxdo-dev \
+            patchelf \
+            wget
       - name: Install cargo-nextest
         uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
         with:
@@ -684,6 +713,16 @@ jobs:
           done
           cat /tmp/buzz-relay.log
           exit 1
+      - name: Desktop relay acceptance gate
+        # NIP-IA owner-consent proof: in-crate ignored tests under
+        # commands/identity_archive::relay_acceptance, exercised against the
+        # production build_router/POST /events path here (not in unit-test gate,
+        # which has no infra). Missing/unreachable infra panics — no skip, no
+        # silent Ok. See Plan v9 Amendment 6 for the fixture and assertion spec.
+        run: just desktop-tauri-relay-acceptance
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+          RELAY_API_URL: http://localhost:3000
       - name: Invite security tests
         run: |
           cargo nextest run \