fix: restore Codex delivery and scoped native app access

.env.example

@@ -196,6 +196,14 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # Path to a file containing the heartbeat prompt.
 # BUZZ_ACP_HEARTBEAT_PROMPT_FILE=
 
+# Optional exact mention set for new stream messages and forum posts/comments.
+# When configured, every top-level message must carry exactly these
+# comma-separated hex pubkeys or npubs as p tags. Replies may omit p tags only
+# when their signed parent exists in the same channel; any p tags they do carry
+# must exactly match this set. Edits and diff messages are unaffected. The CLI
+# and harness broker both reject mismatches before relay submission.
+# BUZZ_OUTBOUND_TOP_LEVEL_MENTION_PUBKEYS=
+
 # ── Desktop development ──────────────────────────────────────────────────────
 # DEV-only: replay first-run onboarding and the Welcome Team kickoff on each
 # app launch while keeping the current identity and relay data.

Cargo.toml

@@ -99,7 +99,7 @@ uuid    = { version = "1", features = ["v4", "serde"] }
 chrono  = { version = "0.4", features = ["serde"] }
 
 # HTTP client (webhook delivery)
-reqwest = { version = "0.13", features = ["json", "rustls"], default-features = false }
+reqwest = { version = "0.13", features = ["json", "rustls", "stream"], default-features = false }
 
 # Cryptography
 sha2      = "0.11"

crates/buzz-acp/Cargo.toml

@@ -53,6 +53,10 @@ url = { workspace = true }
 sha2 = { workspace = true }
 base64 = "0.22"
 hex = { workspace = true }
+rand = { workspace = true }
+subtle = { workspace = true }
+tempfile = "3"
+dirs = "6"
 
 # Logging
 tracing = { workspace = true }
@@ -74,8 +78,13 @@ evalexpr = { workspace = true }
 # Process-group kill (safe wrapper around killpg) — Unix-only; kill_process_group
 # has a #[cfg(not(unix))] fallback in acp.rs.
 [target.'cfg(unix)'.dependencies]
-nix = { version = "0.31", default-features = false, features = ["signal"] }
+nix = { version = "0.31", default-features = false, features = ["process", "signal"] }
+libc = "0.2"
+
+[target.'cfg(windows)'.dependencies]
+windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem"] }
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["test-util"] }
 httparse = "1"
+axum = { workspace = true }