buzz CLI: panics with rustls CryptoProvider error

> *Posted by Angel, a Buzz agent, on behalf of @dmnyc.*

## Bug

The `buzz agents draft-create` (and likely `draft-update`) subcommands panic with a rustls `CryptoProvider` error. All other buzz CLI subcommands (messages, channels, canvas, etc.) connect and work fine — only the agents code path is affected.

## Reproduce

```sh
buzz agents draft-create --channel --display-name "Test" --system-prompt "Test"
```

## Error

```
thread 'main' panicked at rustls-0.23.42/src/crypto/mod.rs:249:14:

Could not automatically determine the process-level CryptoProvider from Rustls crate features.
Call CryptoProvider::install_default() before this point to select a provider manually, or make sure exactly one of the 'aws-lc-rs' and 'ring' features is enabled.
```

## Backtrace

```
0: __rustc::rust_begin_unwind
1: core::panicking::panic_fmt
2: core::option::expect_failed
3: rustls::client::client_conn::ClientConfig::builder_with_protocol_versions
4: tokio_tungstenite::tls::encryption::rustls::wrap_stream::{{closure}}
5: buzz_ws_client::connection::publish_event::{{closure}}::{{closure}}
6: buzz_cli::client::BuzzClient::publish_ephemeral_event::{{closure}}
7: buzz_cli::commands::agents::dispatch::{{closure}}
8: buzz_cli::run::{{closure}}
9: tokio::runtime::park::CachedParkThread::block_on
10: tokio::runtime::context::runtime::enter_runtime
11: tokio::runtime::runtime::Runtime::block_on
12: buzz::main
```

## Analysis

The panic occurs through the `tokio-tungstenite` rustls TLS path used by `buzz_ws_client::connection::publish_event`. Other commands (e.g. `buzz messages get`, `buzz messages send`) succeed over the same relay, so they must use a different code path that either installs a CryptoProvider or avoids this rustls entry point.

The `agents` dispatch path calls `BuzzClient::publish_ephemeral_event` → `buzz_ws_client::connection::publish_event` → `tokio_tungstenite::tls::encryption::rustls::wrap_stream`, which calls `rustls::client::ClientConfig::builder_with_protocol_versions()` without a CryptoProvider installed.

## Likely fix

Either:
1. Call `CryptoProvider::install_default()` (e.g. `aws_lc_rs::AwsLcRs::default_provider().install_default()`) early in `buzz_cli::run` or at the start of the agents dispatch path, **or**
2. Ensure exactly one of the `aws-lc-rs` / `ring` features is enabled on the `rustls` dependency so the default provider is auto-detected.

The same install should cover all subcommands so they share one consistent TLS initialization path.

## Environment

- **buzz binary:** shipped with Buzz.app (`/Applications/Buzz.app/Contents/MacOS/buzz`)
- **Architecture:** Mach-O 64-bit arm64
- **OS:** macOS 26.4.1 (Build 25E253)
- **rustls version:** 0.23.42

Start in buzz_cli::run and the agents dispatch path, then trace BuzzClient::publish_ephemeral_event into buzz_ws_client::connection::publish_event and its tokio-tungstenite rustls TLS path. Check how the working messages and channels commands initialize or avoid TLS, then verify draft-create and draft-update no longer panic while other CLI subcommands continue to connect.

Written by the indexing model from the issue text.