buzz-cli panics on agents draft-create because rustls CryptoProvider is not installed

## Summary

`buzz agents draft-create` panics before it can publish the owner-reviewed draft when the CLI opens its WebSocket/TLS path. The failure is a rustls process-level `CryptoProvider` panic, not an auth or relay rejection.

This reproduced with both:

- `buzz agents draft-create ...` when `~/.local/bin/buzz` pointed at the app-bundled CLI
- `/Applications/Buzz.app/Contents/MacOS/buzz agents draft-create ...`

## Reproduction

Run a draft create against a `wss://` relay with `BUZZ_RELAY_URL`, `BUZZ_PRIVATE_KEY`, and `BUZZ_AUTH_TAG` set:

```bash
printf 'You are Hive Lead, the ambient coordinator for this Buzz workspace.' \
| RUST_BACKTRACE=1 buzz agents draft-create \
--channel 9a491620-9b72-4001-a4be-96dbb5cb364f \
--display-name 'Hive Lead' \
--system-prompt -
```

## Observed

The command panics before the draft event is published:

```text
thread 'main' panicked at .../rustls-0.23.42/src/crypto/mod.rs:249:14:

Could not automatically determine the process-level CryptoProvider from Rustls crate features.
Call CryptoProvider::install_default() before this point to select a provider manually, or make sure exactly one of the 'aws-lc-rs' and 'ring' features is enabled.
```

Relevant backtrace frames:

```text
rustls::client::client_conn::ClientConfig::builder_with_protocol_versions
tokio_tungstenite::tls::encryption::rustls::wrap_stream::{{closure}}
buzz_ws_client::connection::publish_event::{{closure}}::{{closure}}
buzz_cli::client::BuzzClient::publish_ephemeral_event::{{closure}}
buzz_cli::commands::agents::dispatch::{{closure}}
```

## Expected

The CLI should publish the owner-reviewed draft request and return the normal draft-create JSON response instead of panicking.

## Root Cause

`buzz-cli` reaches `buzz-ws-client` / `tokio-tungstenite` for ephemeral event publishing, but the CLI binary does not install a rustls crypto provider at startup. The workspace dependency graph includes both `ring` and `aws-lc-rs` transitively, so rustls cannot auto-select a provider.

Other binaries already handle this explicitly, for example `buzz-relay`, `buzz-admin`, `buzz-acp`, and test clients install a rustls provider before TLS use. `buzz-cli` appears to have missed the same startup initialization.

## Local Fix Prepared

Local checkout branch: `fix/buzz-cli-rustls-provider`

Local commit: `8990138ca4ad04f122699909bc1d3aa523a27bb9` (`fix: install rustls provider for buzz cli`)

Patch shape:

- Add `rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }` as a direct `buzz-cli` dependency.
- Install the ring provider at `crates/buzz-cli/src/main.rs` startup before `run_from_args`:

```rust
let _ = rustls::crypto::ring::default_provider().install_default();
```

## Validation From Local Fix

After building the patched CLI, the original Hive Lead draft command succeeded:

```json
{
"accepted": true,
"action": "create",
"event_id": "1f04ab472cfae1eea58d5a07864ce76370779e4f17d361fd6fe06bf04f074f99",
"message": "Draft sent to Buzz Desktop for owner review. Nothing changes until the owner saves it.",
"request_id": "9391b2c4-7995-4255-afc1-10fa576c4a5d",
"saved": false
}
```

Local checks passed at commit `8990138ca4ad04f122699909bc1d3aa523a27bb9`:

- `cargo fmt -p buzz-cli -- --check`
- `cargo build -p buzz-cli`
- `cargo test -p buzz-cli` (`250 passed`)
- `cargo clippy -p buzz-cli -- -D warnings`

## Release Follow-Up

The fix needs to ship in the desktop app bundle because `/Applications/Buzz.app/Contents/MacOS/buzz` still contains the panicking CLI until replaced by a build with this provider initialization. Other `buzz-cli` commands using the same WebSocket-only ephemeral publish path may be affected too.

Start with crates/buzz-cli/src/main.rs and the buzz-cli dependency configuration, then compare rustls startup handling in buzz-relay, buzz-admin, buzz-acp, and test clients. Run cargo build -p buzz-cli, cargo test -p buzz-cli, and the provided draft-create command against a wss:// relay; done means the command returns its normal JSON response without a CryptoProvider panic.

Written by the indexing model from the issue text.