buzz-cli: plumb include_aux so messages thread/get can see reactions

`buzz messages get` and `buzz messages thread` cannot see reactions, and the relay already has the feature that fixes it.

`crates/buzz-relay/src/api/bridge.rs:383-394` defines:

```rust
WINDOW_AUX_KINDS = [deletion, reaction, nip29_delete, edit]
```

and `bridge.rs:494` implements an `include_aux` extension flag that walks a two-hop closure: reactions and deletions e-tagging the returned rows, then deletions of those. **The relay already treats reactions as thread content.**

```
rg 'include_aux|include_summaries' crates/buzz-cli/ -> exit 1, ZERO hits (whole crate)
positive control: rg -c 'depth_limit' crates/buzz-cli/src/commands/messages.rs -> 5
```

Scope of that negative: the entire `buzz-cli` crate.

## Why it matters

On the `buzz-security` review thread, 290 live kind-7 reactions attach to 195 of 277 messages — **70%** — and none are visible to either command. `messages get`'s default kind list covers 943 of 2234 events seen on a candidate-set probe of that channel (42%).

This has a second-order effect on measurement, not just display: any "how many events are in this second" probe built on `messages get` is kind-scoped, so it undercounts. On the reviewed corpus, tie second `1785163671` reports multiplicity 2 with the default kinds and 3 with `--kinds 7,9` — a kind-7 event sits in that second. Max multiplicity across the channel is 2 in the default scope and 4 widened. Anyone sizing a page cap against the default scope is under-capping for the corpus that actually exists.

## Proposal

Plumb `include_aux` as a CLI flag on `messages thread` (and probably `messages get`). It converts thread-with-reactions from a product argument into a flag, and it is smaller than reconciling the two commands' divergent kind lists.

It needs its own review rather than riding along with a pagination change: aux closure semantics and dedup of two-hop deletions are a second surface with their own failure modes.

## Context

Split out of #6004 (composite pagination cursors), which documents the exclusion in `--help` but does not fix it. Found by @Dawn during an adversarial CLI audit; the reaction counts and the kind-scope multiplicity numbers are from that thread.

Related pattern worth noting separately: this is the third instance of a relay capability with no CLI surface, alongside the thread cursor and `before_id` (both fixed in #6004). The generator — no contract test that every bridge extension flag has a CLI surface — is what makes a fourth instance likely.

Start in crates/buzz-cli/src/commands/messages.rs and run the existing rg checks for include_aux and include_summaries, then read crates/buzz-relay/src/api/bridge.rs around lines 383-394 and 494. Done means messages thread and get expose include_aux, preserve the relay's two-hop auxiliary closure, and handle deduplication of two-hop deletions.

Written by the indexing model from the issue text.