fix(relay): multi-pod subscription coherence (one access-gated fan-out path + cross-pod cache invalidation + REQ/COUNT DB guard)

[tlongwell-block]

Relay multi-pod subscription coherence

After scaling the relay 1→2 pods, agents intermittently weren't subscribed to rooms they'd just been added to (stopping/respawning fixed it). Root cause: each pod keeps in-memory (moka) membership / accessible-channels / visibility caches with only a 10s TTL and no cross-pod invalidation. A membership change applied on the writer pod left the other pod serving stale is_member / accessible-channels for up to the TTL — denying valid subscriptions and returning empty create-channel readbacks.

Design doc: RESEARCH/RELAY_MULTIPOD_SUBSCRIPTION_GAP.md. One PR, three commits, in order.

Commit 1 — invariant: one access-gated EVENT fan-out path (53ee54e)

Establishes the load-bearing invariant for the whole fix: no relay-local channel-scoped EVENT delivery can bypass filter_fanout_by_access. A single helper (fan_out_event_to_local_subscribers) does fan_out → filter_fanout_by_access → serialize → send loop → drop-count. 8 raw callsites routed through it (net −61 lines: consolidated duplicate loops).

Audit of every production fan_out → send_to(EVENT) callsite (base 8568159):

#	callsite	channel_id	kind(s)	before	action
1	event.rs dispatch_persistent_event	Some/None	persistent	GATED ✓	left (extra per-recipient DM-visibility gate)
2	event.rs fan_out_pubsub_event	Some/None	persistent	GATED ✓	left (skips local echoes)
3	event.rs:600 ephemeral channel	Some	ephemeral	BYPASS ✗	routed thru helper
4	event.rs:637 ephemeral global	None	24134	global no-op	routed thru helper (uniformity)
5	event.rs:829 agent-observer	None	24200	global no-op	routed thru helper
6	audio/handler.rs:793	Some	audio lifecycle	BYPASS ✗	routed thru helper
7	side_effects.rs:608 membership notif	None	custom #p	global no-op	routed thru helper
8	side_effects.rs:2153 ref-state	None	30618	global no-op	routed thru helper
9	side_effects.rs:2242 NIP-43 announce	None	8000 #p	global no-op	routed thru helper
10	mesh_signaling.rs:319 call-me-now	None	24622 #p	global no-op	routed thru helper
11	transport.rs:1116 ref-state git	None	30618	global no-op	routed thru helper

req.rs historical delivery is REQ-response, not live fan-out — already gated by accessible_channels; handled by commit #3, not here. Safety: AUTHOR_ONLY_KINDS = [30300] only; none of the global callsite kinds are 30300, so routing them through is a true no-op today (verified buzz-core/src/kind.rs).

Commit 2 — coherence: cross-pod cache-key invalidation over Redis pub/sub (eb2b1ed)

A dedicated buzz:cache-invalidate Redis topic carries each cache-key drop to every pod immediately. The message is a pure cache-key drop, never an "evict these subscriptions" payload — the commit-1 access gate is the universal delivery-enforcement point, so dropping the stale key is sufficient (next read re-fetches authoritative DB state).

• buzz-pubsub: CacheInvalidation enum (one variant per invalidate_* op), publish_cache_invalidation, subscribe_cache_invalidations, reconnecting subscriber loop mirroring run_subscriber.
• state.rs: each public invalidate_* does the local moka drop and fire-and-forget spawns the matching publish — all ~13 call sites untouched. The cross-pod consumer calls private *_local drop variants via apply_cache_invalidation, so a received drop is never re-published (no fan-out loop).
• main.rs: spawn the subscriber + a consumer loop mirroring the multi-node event fan-out consumer.

A missed publish degrades to the ≤10s TTL wait, backstopped by commit #3 — never a leak.

Commit 3 — guard: denial-path DB confirmation in REQ/COUNT (3011abd)

The backstop for the brief window before a TTL expires or an invalidation lands. accessible_channels is a per-request Vec built once from the cache and reused for subscription registration, historical delivery, search scope, and COUNT. On a cache-negative for the targeted channel, confirm membership against the DB uncached; on a verified positive, push ch_id into the Vec via the pure helper resolve_request_local_access. The confirmation is request-local-authoritative: one repair, and registration + historical + COUNT all see it — a stale negative can't stay sticky for the rest of the request.

Truth table (unit-tested, all three cases):

• cache contains ch_id → allowed, no DB, no repair
• cache-miss + DB member → allowed, ch_id pushed (repair)
• cache-miss + DB non-member → denied, vector unchanged

Mirrored in count.rs through the same shared helper.

Verification

• cargo build --workspace clean; cargo clippy -p buzz-pubsub -p buzz-relay clean.
• cargo test -p buzz-relay -- --test-threads=1 → 367 passed (364 baseline + 3 new helper tests).
• cargo test -p buzz-pubsub -- --ignored against live Redis → 6 passed, including test_cache_invalidation_roundtrip (publish on one manager, receive the exact CacheInvalidation on another's subscriber — actual cross-pod propagation).
• DB truth the guard relies on (is_member after add_member) is covered by existing #[sqlx::test] membership tests in buzz-db/channel.rs.

Notes / out of scope

• End-to-end handler harness: this crate has no AppState+DB test harness (all relay tests are in-memory; AppState::new needs Db+Redis+audit+pubsub+auth+search+workflow+keypair+S3 GitStore and spawns workers). Standing one up was disproportionate to a ~30-line diff and a fragile harness is its own risk. The request-local-repair invariant is proven by the pure-helper tests; DB truth by the existing buzz-db tests. (Reviewed with Perci.)
• fix(channels): poll relay read-back after create/update to fix metadata race #1255 noted out of scope.
• Pre-existing test-isolation debt (not introduced here): the 3 fanout_access tests can fail intermittently under a parallel run because config.rs tests set_var bogus BUZZ_BIND_ADDR/BUZZ_GIT_REPO_PATH that a concurrent Config::from_env() reads. Full suite passes single-threaded (367/367) and the scoped fanout tests pass parallel. Flagging, not fixing, in this PR.