fix(acp): route ordinary channel requests standalone

[thomaspblock]

Summary

• make ordinary channel requests resolve to buzz channels create, including inside project homes
• reserve buzz projects add-channel for explicit project-linking language and forbid inference from task/worktree/repository context
• lock the routing contract with a shared-prompt regression test

Walkthrough

Before

An ordinary “fresh work channel” request could be interpreted as project-linked, opening an owner-review flow and blocking non-owners.

After

The same request creates a standalone channel. Explicit language such as “project channel” or “link it to this project” continues to use owner review.

Testing

• cargo fmt --all -- --check
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo test -p buzz-acp — 934 unit tests passed, 1 ignored; 9 lifecycle tests passed
• full pre-push Rust and Desktop/Tauri checks passed

The first full package run hit the existing timing-sensitive keepalive_resets_idle_past_deadline test once; two subsequent complete package runs passed.

Post-deploy validation

• from a project home, ask an agent to “create a fresh work channel” and verify it uses standalone creation without owner review
• ask it to “create a project channel linked to this project” and verify it opens the existing owner-reviewed request

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 813bbd14121edacc6cb4733301a3af12131aa10e...24f97df1c6cd0b5b0cbeaa0db5d0d02efdbb94c9.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 24f97df1c6cd0b5b0cbeaa0db5d0d02efdbb94c9 to authorize a new review.
Any previous review applies only to its recorded range.