Cap consecutive teammate triggers and configure permission setup timeout

[sbddesign]

Agent teams can mention one another indefinitely because buzz-acp currently relies on prompt instructions to stop loops. This adds an opt-in BUZZ_ACP_TEAM_PUBKEYS guard: six consecutive teammate-directed triggers are allowed, then later teammate triggers are dropped until an admitted human posts in the same scope. Top-level channel posts share one channel counter; replies use their canonical thread root. Edits and an agent's own team-directed posts count. Human-triggered turns always run.

A reset requires an admitted effective author who is the bound owner or explicitly allowlisted, a direct signer (not a relay-signed workflow), a non-bot channel role, and no NIP-OA profile tag. The role/profile verdict is cached per author and channel for 60 seconds. A customer-allowlisted Kettle agent with a plain member role and no NIP-OA profile tag counts as human for resets. The counter is in memory, so a process restart permits another six turns.

The same patch makes the ACP permission-mode setup timeout configurable with BUZZ_ACP_PERMISSION_MODE_TIMEOUT while retaining the five-second default. Hosted cold starts can set a longer value without changing everyone else.

Validation: cargo fmt --all --check, cargo clippy -p buzz-acp --lib --tests -- -D warnings, and the full supported buzz-acp package suite pass on this head (1,073 library tests passed, three ignored). Two native-Git credential bootstrap tests fail at git credential fill on the pre-patch base under local Git 2.39.1 and were excluded from the supported run. Behavioral tests cover alternating top-level posts, rejected and allowed resets, self-counting, edits, cache expiry, and configured permission-mode behavior. Six mutations were run and caught: disabled drop gate, pre-authorization reset, unconditional reset, disabled self-counting, and hard-coded timeouts in runtime or pool.

This PR remains draft pending human runtime validation.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is b77ba862627c7362a4b863a0a077677d811a7558...9a7f8b5875ecbad6bcc7acf98fb4510b1bba4bc6.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review 9a7f8b5875ecbad6bcc7acf98fb4510b1bba4bc6 to authorize a new review.
Any previous review applies only to its recorded range.