CLI: buzz repos protect set always rejected — relay 400 "event timestamp too far from server time" #4431

Describe the bug
Every invocation of buzz repos protect set is rejected by the relay with a timestamp-out-of-bounds error, even though the client clock is NTP-synced. Branch/tag protection rules cannot be managed from the CLI at all.

Steps to reproduce

On a machine with an NTP-synced clock, as the repo announcement's author, run:
buzz repos protect set --id bag-room --ref refs/heads/zz-repro-test --push member
See the relay 400 below (CLI exit 2); fails 100% of the time
From the same shell and identity, seconds apart, run any other event-publishing command (buzz messages send, buzz repos create) — accepted, ruling out client clock skew
Expected behavior
The protection rule is created/replaced for the given ref pattern.

Version and platform

Buzz version: 0.5.3
OS: Windows 11 Home (build 26200)
Logs / additional context

json
{"error":"relay_error","message":"relay error 400: invalid: event timestamp too far from server time","retryable":false}
Copy code block
Reproduced 2026-08-02T23:47Z against bagroom.communities.buzz.xyz. Since sibling commands from the same clock are accepted, the protection-rule event appears to get a bad created_at — or the relay validates this event kind against a different time bound. Likely shares a root cause with the buzz repos bind issue filed alongside this one.