[Bug] buzz agents draft-create panics on secure relay path due to missing rustls CryptoProvider selection

**Describe the bug**
buzz agents draft-create panics before completing the request when it tries to publish the owner-reviewed Desktop draft over the secure relay path. The failure appears to be in the Buzz CLI / websocket client TLS initialization path, not in the agent prompt, channel context, or Garsonista-specific setup.

**To Reproduce:**
Run:
bash
buzz agents draft-create \
--channel 011a8d17-1153-5550-80cb-c8a4797db14c \
--display-name Garsonistas \
--system-prompt test
Copy code block
Let the CLI attempt to publish the owner-reviewed draft over the configured secure relay.
Observe the command crashing before the draft is created.

**Expected behavior:**
buzz agents draft-create should successfully create and publish the owner-reviewed Desktop draft over the secure relay path, without requiring manual TLS/provider setup.

**Supporting Material**
Observed panic:
text
Could not automatically determine the process-level CryptoProvider from Rustls crate features.
Call CryptoProvider::install_default() before this point to select a provider manually, or make sure exactly one of the 'aws-lc-rs' and 'ring' features is enabled.
Copy code block
Relevant backtrace frames from RUST_BACKTRACE=1:
text
rustls::client::client_conn::ClientConfig::builder_with_protocol_versions
tokio_tungstenite::tls::encryption::rustls::wrap_stream
buzz_ws_client::connection::publish_event
buzz_cli::client::BuzzClient::publish_ephemeral_event
buzz_cli::commands::agents::dispatch
Copy code block
Additional investigation:
Standard secure relay path panics immediately with the rustls CryptoProvider error.
Forcing a plain HTTP relay path avoided the immediate panic but did not produce a usable fallback response, so there does not appear to be a practical shell-level workaround from this environment.

**Environment (please complete the following information):**
OS: macOS
Version: observed on 2026-07-23 in the managed Buzz agent environment

**Additional context**
This appears to be a secure relay / websocket / TLS client initialization issue in the Buzz stack. The most likely fix area is the rustls provider setup in the secure publish path, for example ensuring exactly one provider is enabled or explicitly calling CryptoProvider::install_default() before client config construction.
It is not caused by:
missing BUZZ_AUTH_TAG
invalid agent prompt contents
wrong channel/thread metadata
Garsonista-specific configuration

Reproduce with the documented buzz agents draft-create command and RUST_BACKTRACE=1, then trace the secure path from buzz_cli::commands::agents::dispatch through BuzzClient::publish_ephemeral_event and buzz_ws_client::connection::publish_event. Inspect the rustls and tokio-tungstenite TLS provider configuration at the reported panic. Done means the command publishes the owner-reviewed draft over the secure relay without the CryptoProvider panic.

Written by the indexing model from the issue text.