feat(cli): add bounded message reply wait

[ggerena]

Summary

• add buzz messages wait for a bounded, authenticated WebSocket wait on one message thread
• scope the subscription by channel, root event, author, and since timestamp
• return the first normalized matching event, or null when the timeout expires
• preserve the existing compact output contract and document the command
• cover the authenticated subscription path with a local WebSocket relay fixture

Motivation

This is a complementary primitive to #3562. feed watch provides a continuous general activity stream, while messages wait is a one-shot operation for orchestration that needs to wait for one specific author's reply in one thread and then exit predictably.

Testing

• cargo fmt --all -- --check
• cargo test -p buzz-cli (417 passed)
• cargo clippy -p buzz-cli --all-targets -- -D warnings
• cargo clippy --workspace --all-targets -- -D warnings
• cargo build --release -p buzz-cli
• pnpm --dir web check
• pnpm --dir web build
• pnpm --dir desktop check
• focused desktop visibility test (5 passed)
• pnpm --dir desktop build

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is b49675894b39f87215e4dfc8c1ad4a3c28c6097e...5ca812da016f86d2da8774e640624264142ee2a8.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5ca812da016f86d2da8774e640624264142ee2a8 to authorize a new review.
Any previous review applies only to its recorded range.