B5 residue: inbound-event security hardening + persona→agent copy sweep

[wesbillman]

B5 residue: inbound-event security hardening + persona→agent copy sweep

Follow-ups from the #1667 review and the unified-agent-model workstream
(PLANS/UNIFIED_AGENT_RESIDUE_BACKLOG.md). Both commits Pinky-reviewed.

1. Security (b9b1869ec) — the two gaps flagged in the #1667 review

• Inbound signature gate: reconcile_inbound_persona_event now verifies
  event signatures immediately after parse (parse_verified_inbound_event),
  before the store lock, retention rows, and every apply/tombstone branch.
  Everything downstream trusts event.pubkey (ownership routing, behavioral-
  quad application, tombstone scoping), so a forged pubkey dies at the door.
  This is the ONLY inbound agent-store mutation path (sweep of every non-test
  Event::from_json in-tree, independently verified in review); the observer
  decrypt path already verified, the archive pipeline is a separate
  store-only trust domain.
• Tombstone owner scoping (NIP-09): parse_deletion_coordinate now
  requires the coordinate's owner segment to match the verified
  event.pubkey — a validly signed kind:5 naming another owner's coordinate
  no-ops instead of deleting their record.
• Tests: tampered-reject, valid-accept, foreign-owner-reject; existing
  coordinate tests migrated to self-owned fixtures.
• Perf note: the gate runs on every backfill event on first boot — ≤500
  schnorr verifies at ~100µs each, negligible.

2. Copy sweep (8d5619ca0) — Category-C persona→agent strings

User-surfacing strings that still said "persona" after the model unified on
"agent": mention-autocomplete fallback label, and the error-toast family
("agent {id} not found", "Built-in agents cannot be edited/deleted",
"Only built-in agents can be added to or removed from My Agents") across the
persona commands, ensure_persona_is_active (surfaces via agent start and
team create/update), and the catalog gate. The mock bridge throws the
verbatim Rust strings so backend/bridge string parity holds.

Deliberately unchanged (on record from review): internal identifiers
(persona_id, kind:30175 naming, slugify prefix) and three backticked
developer-facing diagnostic strings (env_vars.rs:336, agents_deploy.rs:67,
writeback.rs:79).

3. Decision record (8778cfc82)

Wes's two design calls, decided 2026-07-09 in-channel:

• Definition-only create keeps requiring a runtime (1a) — already the
  shipped behavior; recorded, zero diff.
• Avatar is definition-level identity (2a) — the instance dialog's
  read-only avatar now says so honestly instead of claiming the backend
  can't persist it. Companion decision: fix(desktop): persist agent avatar edits #1666 (per-instance avatar edits,
  written against the pre-B5 model) closed with rationale; it becomes the
  starting point if per-instance avatar demand appears later.

Testing

Rust 1121/1121, frontend 2266/2266 (post-rebase onto 46613dc), tsc/biome/check scripts/both fmt passes
clean; agents.spec + persona-env-vars e2e (the specs asserting these exact
strings) 15/15 on --project=integration.

[wpfleger96]

🤖 Team review — 3/3 APPROVE, no blocking defects.

Both #1667 security findings are correctly closed:

• Sig verification (parse_verified_inbound_event) runs at mod.rs:386, first line of reconcile_inbound_persona_event_blocking, before any store mutation. event.verify() at mod.rs:485-487 propagates on failure.
• Tombstone owner scoping (parse_deletion_coordinate) checks owner != event.pubkey.to_hex() at mod.rs:510, returns None on mismatch. Foreign-owner deletions are silent no-ops.

Copy sweep verified 7/7, deliberately-unchanged strings confirmed 3/3.

Two non-blocking MINORs noted as inline comments below. CI 25/25 green at head 8778cfc82.

---

Defense-in-depth suggestion (non-blocking, future hardening): could also check event.pubkey == state.keys.public_key() backend-side before applying inbound sync, rather than relying solely on the relay authors filter + TS-side check at usePersonaSync.ts:31-33. The relay filter + sig gate is sufficient for the stated #1667 gap, but a backend check would make future caller drift or stale-subscription races harmless.

Copy residue outside this PR's scope (non-blocking, future sweep): e2eBridge.ts has pre-existing Category-C mock strings ("Core engineering personas" at line 1767, "Imported Persona" at line 6583, "references missing personas" at line 6499) not touched by this diff.