RFC: App-integration agents — install a Buzz-managed agent that carries an app's own tools + scoped credentials (headless, owner-approved)

## Summary

A stable, scriptable way for a **third-party app** to install a **Buzz-managed
agent that carries the app's own tools + a scoped credential** — so the agent
does real domain work (not just chat) while Buzz hosts + supervises it. Today a
managed agent (Fizz/Bumble/Honey) is a general assistant with no app tooling, and
the only way to give one app-specific tools + secrets headlessly is blocked.

## Concrete use case (what drove this)

Figura is a design tool. We wanted a Buzz-native **Figura** agent: mention it in a
channel → it builds an on-brand UI mock ("fig") and replies with a link, answers
"what figs do we have?" via our CLI, iterates on a fig in-thread. That needs the
agent's harness to carry:

- the `figura` CLI + `/fig` skill (its tools),
- a **scoped team token** (which team's brand + where figs land),
- a persona/system prompt.

A `builtin:fizz`-style managed agent can't do this — it has no Figura tooling or
credential. So we ended up shipping a **self-hosted daemon** (own Nostr key,
`channels add-member`, launchd) as a workaround. That works, but:

- **It doesn't scale to co-hosts.** If two teammates each run the daemon in the
same channels, both fire on `@figura` → duplicate replies, duplicate figs, each
burning its own model subscription. There's no cross-daemon dedup. A single
**Buzz-managed** agent per community would solve this by construction.

## Why the managed path is blocked today

1. **Managed agents can't carry app tools + secrets headlessly.** Desktop's
Create-agent → Advanced sets `runtime.mcpCommand` + `env_vars`, but the CLI
`agents draft-create` path is a deliberately **no-secret owner-review contract**
(`parseAgentManagementRequest` drops any secret-shaped/unknown key). So an app
installer can't hand over a token/tool via the draft. (#3115 tried the CLI flag
and ran into exactly this.)
2. **Headless provisioning needs a Desktop-minted attestation.** `draft-create`
requires `BUZZ_AUTH_TAG` (NIP-OA owner attestation), which only Desktop mints —
there's no CLI to produce it. So the flow can't run from an app's `setup`.
3. **The deep-link prefill (#2911) still routes to the owner's Desktop form** and
isn't in released builds.

Net: there's no path for "app X installs its working agent into my community" that
carries X's tools + a scoped secret, with owner approval but without hand-walking
the GUI.

## Ask

A stable extension point to register/install a **managed-agent bundle**:

```
{ personaId, displayName, systemPrompt,
harness, // e.g. claude-code
tools: { mcpCommand | mcpServers },
credentials: [ vaultRef ], // scoped secret, egress-substituted, never in the
// owner-review draft or the sandbox
defaultChannels }
```

- **Owner-approved, not owner-hand-authored.** The owner still consents (one
approval), but an app can *prefill the whole bundle* headlessly.
- **Secrets handled safely** — a vault/secret-ref the harness resolves at egress,
distinct from the no-secret draft contract (so #3115's boundary stays intact).
- **This is the layer beneath the marketplace (#2958):** the marketplace discovers/
installs; this defines what a *working, tool-carrying* installed agent IS.

## Relates to
- #2958 — Cross-community agent marketplace (discovery/install)
- #2754 — Stable extension points for downstream integrations (MCP tools + agent lifecycle is one bullet; this is the concrete agent-bundle case)
- #3115 — CLI `--mcp-command`/`--env` (blocked by the no-secret draft contract)
- #2911 — `buzz://install-agent` deep-link prefill

Happy to share the Figura self-hosted-daemon design as a reference for what a
managed equivalent would need to replace.

Start by tracing the agents draft-create path, parseAgentManagementRequest, BUZZ_AUTH_TAG attestation, and the Desktop Create-agent → Advanced flow; review related issues #3115, #2911, #2958, and #2754. Done means an owner-approved, headless managed-agent bundle can carry tools and scoped vault references without exposing secrets in the draft or sandbox.

Written by the indexing model from the issue text.