feat(desktop,buzz-acp): add harness-agnostic config bridge and setup-listener mode

[wpfleger96]

This PR adds a harness-agnostic config bridge that detects unconfigured managed agents and spawns buzz-acp in a minimal setup-listener mode instead of the normal agent pool.

Before this, a managed agent missing its provider, model, or credential keys would fail silently or crash-loop on spawn. Users had no indication what was missing or where to configure it.

• Add readiness.rs to desktop/src-tauri/src/managed_agents: EffectiveAgentEnv resolver, Requirement enum (NormalizedField / EnvKey / CliLogin), and agent_readiness() predicate; covers buzz-agent, goose, claude, codex runtimes with 11 unit tests
• Add requiredCredentialEnvKeys() to personaDialogPickers.tsx mapping runtime+provider to required env keys; EnvVarsEditor gains a requiredKeys prop rendering locked amber rows at top with a Required badge when empty
• Add isMissingRequiredDropdownField() in personaDialogPickers.tsx wired to useAgentConfigSurface().data?.normalized.{model,provider}.isRequired; EditAgentDialog shows required * labels on model/provider dropdowns sourced from the config-bridge normalized surface (single source of truth — flows from KnownAcpRuntime.required_normalized_fields → read_config_surface() → NormalizedField.isRequired)
• Add setup_mode.rs to buzz-acp: SetupPayload deserialization, run_setup_listener() event loop — connects to relay, subscribes channels (mentions-only), applies author gate, and replies with a surface-correct nudge naming each missing requirement; 30s per-channel cooldown and per-event-id dedup; 6 unit tests
• Wire early branch in buzz-acp tokio_main: if BUZZ_ACP_SETUP_PAYLOAD is set, enter setup mode and skip the agent pool entirely
• Wire readiness check in spawn_agent_child (runtime.rs): calls resolve_effective_agent_env() + agent_readiness() after resolving runtime_meta; if NotReady, serializes requirements as BUZZ_ACP_SETUP_PAYLOAD JSON

[wpfleger96]

Shot 01 — Create: buzz-agent selected, provider empty → required marker shown, save allowed

LLM Provider field shows required marker (*); Create agent button is enabled (save no longer blocked by incomplete config).

Shot 02 — Create: buzz-agent + anthropic, model empty → required marker shown, save allowed

Provider selected, model field shows required marker; Create agent button still enabled.

Shot 03 — Create: buzz-agent + anthropic + model set, API key missing → amber required row, save allowed

ANTHROPIC_API_KEY row shown with amber "Required" badge; button enabled (nudge will guide user after spawn).

Shot 04 — Create: all required fields satisfied → Create button enabled

Provider, model, and credential all set; button enabled as expected.

Shot 05 — Create: claude (CLI-login) runtime → no provider/model required, button enabled

Claude uses out-of-band auth; provider/model fields hidden; button immediately enabled.

Shot 07 — Edit: goose runtime, extracted provider + model fields shown

Edit Agent dialog showing the shared AgentProviderField / AgentModelField extraction.

Shot 08 — Create: goose runtime, provider empty → required marker shown, save allowed

Same required-marker behavior as buzz-agent (both support provider selection).