fix(cli): stamp repo-announcement updates with max(now, head+1) (#2876) - #4363

Problem

buzz repos protect set / protect remove / bind permanently fail 15 minutes after a repo is announced (#2876). build_updated_repo_announcement stamped the replacement announcement at existing.created_at + 1, but the relay rejects any event whose created_at drifts more than MAX_TIMESTAMP_DRIFT_SECS (±900s) from server time. Since the advance is +1 and never catches up, once an announcement is >15 min stale every mutation is rejected deterministically — branch protection becomes permanently unchangeable, and repos bind (the documented recovery for #2877) is unreachable. Independent repro by @A-PachecoT confirmed all three commands hit the same path.

Fix

Stamp the replacement with max(now, existing + 1):

• The +1 floor is preserved. A delayed writer still can't leapfrog an intervening update and silently erase metadata — if it observed a stale head, the floor keeps its replacement ahead of that head. Replay-protection intent unchanged.
• The wall-clock floor restores freshness. A writer acting on a fresh observation now lands inside the relay's drift window. This is the single shared choke point, so protect set, protect remove, and bind are all fixed by the same change.

crates/buzz-cli/src/commands/repos.rs — the only file touched.

Tests

• Two pre-existing asserts (assert_eq!(created_at, 101)) encoded the old semantics; relaxed to >= 101 (the floor invariant they actually pin down — wall-clock now (2026+) always exceeds the 100 base, so behavior on a live writer is unchanged).
• New updated_announcement_stays_within_relay_drift_window_for_stale_head: announcement made 2h ago → replacement drifts ≤900s from wall clock and advances past the stale head. This is the buzz repos protect set and repos protect remove are rejected by the relay's timestamp drift check on any repo announced more than 15 minutes ago #2876 regression, pinned.
• New protection_set_preserves_metadata_and_protections: auth tag stripped, the matching refs/heads/main rule replaced, unrelated protections + future metadata preserved, and the leapfrog guard verified.
• cargo test -p buzz-cli --lib repos:: → 17/17 green; full buzz-cli --lib baseline clean; cargo clippy -p buzz-cli --lib clean.

Behavior is timestamp-only — no relay change, no API change. Host: macOS aarch64-apple-darwin; the path is platform-independent Rust.