Desktop managed-agent reconciler retries a stale-timestamp kind 30177 event every 30s forever after relay rejection

## Symptom

Self-hosted relay (image `sha-fb4a801`), one desktop client. The relay logs this rejection in bursts of ~3, every ~30 seconds, continuously — observed for 19+ hours with no backoff and no resolution:

```json
{"level":"WARN","message":"HTTP bridge request","pubkey":"0d6a7de6…","route":"/events","status":400,"accepted":false,"kind":30177,"reason":"invalid: event timestamp too far from server time","target":"buzz_relay::api::bridge"}
```

Kind 30177 is `KIND_MANAGED_AGENT`. The client's system clock is correct; the event being published appears to be a stored managed-agent definition whose original `created_at` is now outside the relay's drift window — plausibly an agent defined earlier (or against a different relay) that the desktop reconciler (`managed_agents/reconcile.rs`) is trying to sync to this relay verbatim.

## Problems

1. **The retry can never succeed** — republishing the same event keeps the same stale `created_at`, so the relay rejects it identically every time. The managed agent silently never syncs.
2. **No backoff on a permanent-failure class** — `invalid:` 400s are deterministic rejections, but the reconciler retries at a fixed ~30s cadence indefinitely, spamming relay logs and doing useless work.
3. **Nothing surfaces to the user** — no desktop UI signal that a managed agent is failing to reconcile.

This looks like the same drift-window family as #2876 (repos protect commands rejected for >15-min-old announcements), but on the managed-agent reconcile path.

## Ask

- Reconciler should re-sign the managed-agent event with a fresh `created_at` when (re)publishing (it owns the keys — parameterized-replaceable semantics make refreshing the timestamp the correct behavior), and/or
- treat `invalid:` rejections as permanent: stop retrying, surface the failure in the UI.

Workaround that clears it: delete and re-create the managed agent in the desktop app.

Related: #2876 (timestamp drift window on git repo announcements).