CLI: preserve public Nostr signature in messages get JSON

## Summary

`buzz messages get --format json` drops the public Nostr `sig` field while normalizing relay events. Downstream clients can therefore receive an event's `id`, `pubkey`, `kind`, `content`, `created_at`, and `tags`, but cannot independently verify the event's BIP-340 signature.

This blocks signed result collection in PlotPickle: the relay event is signed, but the CLI representation removes the proof needed to verify it.

## Affected versions

Confirmed by source inspection in:

- Desktop v0.5.19
- Desktop v0.5.20
- Current `main` as of 2026-08-26

In `crates/buzz-cli/src/client.rs`, `normalize_events` constructs the JSON response with `id`, `pubkey`, `kind`, `content`, `created_at`, and `tags`, but not `sig`.

## Expected behavior

The full/default JSON returned by:

```console
buzz messages get --channel --format json
```

should preserve the relay event's public signature:

```json
{
"id": "...",
"pubkey": "...",
"sig": "...",
"kind": 9,
"content": "...",
"created_at": 0,
"tags": []
}
```

The compact format may remain reduced if that is its intended contract.

## Actual behavior

The same event is returned without `sig`. A downstream consumer cannot reconstruct or authenticate the missing signature and must either reject the event or weaken verification.

## Security and custody

The Nostr event signature is public event data, not a private key or authentication secret. Preserving `sig` does not change private-key custody and should not expose `BUZZ_PRIVATE_KEY`, `BUZZ_AUTH_TAG`, or any hidden credential.

## Suggested acceptance criteria

- Full/default `messages get --format json` output includes the original `sig` alongside `id` and `pubkey`.
- The signature is preserved unchanged from the relay event.
- A unit regression test covers `normalize_events`.
- Compact output remains unchanged if desired.
- No change is made to private-key or auth-tag handling.

## Downstream context

PlotPickle issue: https://github.com/BryanHarrisScripts/PlotPickle/issues/1422

PlotPickle draft PR with fail-closed verification and a collector parsing fix: https://github.com/BryanHarrisScripts/PlotPickle/pull/1441