fix(relay): owner_only rejection names the agent owner who can act (#4225)

[iroiro147]

What

When a community owner/admin tries to add an agent to a channel and the agent's
channel_add_policy is owner_only, the relay rejected them with:

policy:owner_only — only the agent owner can add this agent

…but never said who the owner is. Address #4225.

Changes

• crates/buzz-relay/src/handlers/side_effects.rs
  • Extract the rejection string into a pure helper, owner_only_rejection.
  • Include the agent owner's hex pubkey in the message so the rejected actor
    knows exactly which key is authorized to perform the add:

    policy:owner_only — only the agent owner (<hex-pubkey>) can add this agent
    

  • The policy:owner_only tag is preserved for downstream pattern-matching.
• crates/buzz-test-client/tests/e2e_relay.rs
  • Strengthen the existing test_nip29_put_user_owner_only_blocks assertion to
    also require the rejection to say who can act.

Tests

• New unit test owner_only_rejection_message_names_owner_pubkey covers the
  helper: contains policy:owner_only, the owner hex, and the action denial.
• Existing e2e gate extended (assertion-only; unchanged actors).
• Suite receipts: cargo test -p buzz-relay --lib side_effects 6/6 pass;
  cargo test -p buzz-relay --lib bridge 59/59 pass; full workspace
  buzz-workflow --lib 153/153 pass.

Out of scope / pre-existing

The broader buzz-relay --lib suite has nine pre-existing failures in
api::media and api::admin (500 vs 404 assertion mismatches) that reproduce
on main and are unrelated to this change.

Refs #4225