Fix remote Huddle ending cleanup - #9376

When the creator leaves a Huddle with only agents connected to audio,
desktop now publishes the ended state and archives the room. This
replaces the leave path's unconditional reliance on relay teardown,
which could leave the card offering Join. The existing View action and
transcript membership are preserved.

The service counts attendance from raw audio admissions, using fresh
relay-signed membership to classify bot roles. Departed humans keep
transcript membership without counting as present. Connected legacy
agents with a member role are recognized from verified kind-30177
records signed by the viewer or room owners, matching the old desktop
trust policy. Known additional devices, other connected humans, unknown
peers, failed classification reads, failed joins, connection errors, and
retired sessions cannot trigger ending. Native signing now validates and
permits the existing 48103 event. Concurrent relay archival is confirmed
as successful cleanup.

This is the desktop client counterpart to [mobile
#9375](block/buzz#9375); [relay
#9376](block/buzz#9376) remains independent.
Only the creator or relay may announce an ending. Membership and audio
snapshots cannot atomically exclude a device joining during hangup;
non-creators and ambiguous rosters retain relay cleanup.

Validation: typecheck and all 63 Huddle service tests pass. Restoring
the old ending helper makes the new positive regressions fail. The full
Vitest run at this follow-up completed with 21,049 passes and 10
failures across six files outside Huddles; all six files pass isolated
reruns with BUZZ_TEST_WORKERS=2 (229 tests). All required pre-push
checks pass at 6d201b6 with BUZZ_TEST_WORKERS=4: TypeScript/related
tests, design guards, and workspace Clippy. Independent review found no
blockers.

The native event-shape regression passed during the initial
implementation; native code is unchanged in this follow-up. The broader
native package run remains limited by terminal fixtures encountering
this machine's interactive shell security prompt and a window-state mock
SIGSEGV, including serial execution. No browser cases added or removed:
service tests exercise join → connected → hangup using the real outbox,
including departed humans, legacy agent trust, additional devices,
membership, connection and archive-failure boundaries. Existing Huddle
card/View tests pass.

Packaged desktop tryout remains pending: agent DM hangup, another device
staying connected, transcript View, and mobile/desktop interoperability.
No deployment or live-device validation claimed.

---------

Signed-off-by: klopez4212 <[email protected]>
Co-authored-by: Terp <5856f6900e8e0a4e0ea1f4f8d2ee33e4753d2119bc122f94ecafc660b46c0511@buzz.block.builderlab.xyz>

…9375)

## Summary

Leaving an agent DM Huddle previously skipped client lifecycle cleanup,
allowing Join to remain visible while the relay waited for the agent.
Apply the existing last-human rule to DMs: release audio first, then
publish the ending and archive when the human count is at most one.
Preserve the existing additional-device and same-Huddle rejoin guards.
Retain DM membership when other humans remain so hanging up does not
revoke transcript access.

Offer **View** only when cached backing-room membership confirms
transcript access, opening the original Huddle transcript and reply
threads without joining audio. Non-members retain disabled Ended.
Preserve Open for an active local session even when an ended event
arrives.

For admitted or just-left Huddles, switching/removing a community
retires pending remote finalization and waits for local audio teardown.
Generation guards prevent retired count/end results from launching
follow-up writes or interfering with a later call. Existing in-flight
Huddle-start rollback behavior is unchanged.

Client only; remote relay finalization is separate in #9376. Human
counts use backing-channel membership; known duplicate owner admissions
prevent client cleanup. Concurrent device arrivals are not made atomic
by this client-only change, and human-to-human DMs with retained
memberships still rely on relay finalization.

### Related issue

Split from the combined Huddle repair at the author's request. Searched
open Huddle issues/PRs; no exact duplicate found for this mobile
behavior.

### Testing

Follow-up fixes are in `7f28dc486`; merged current main in `7a592f19d`.
Required push checks pass on the merged head.

- Mobile formatting, analysis, and full suite passed (4,705 tests, 71
skipped; supplementary suites: 4 and 27).
- DM hangup journey covers sole-human ending, preservation of another
owner device, and preservation of membership when another human remains.
Existing rejoin/lifecycle regressions remain in the full suite.
- View journey reads the original transcript and opens a server-only
reply-thread summary without joining audio.
- Mutation checks: restoring the DM cleanup exemption fails the
last-human journey; removing thread summaries fails View navigation.
Restored production code passes.
- Independent review completed; follow-up review of the three blocking
fixes found no remaining blockers.
- Follow-up regressions cover live-call Open after an ended event,
reactive history membership revocation, stalled count/end requests
during community transition, and background teardown of a later call
while retired cleanup is unresolved.

Phone/human validation remains pending. Start an agent DM Huddle and
leave from the last human device: its card should stop offering Join.
Tap View to read the transcript and replies. Repeat with another device
still in the Huddle and verify it stays open. Not deployed.

---------

Signed-off-by: kenny lopez <[email protected]>
Co-authored-by: Terp <5856f6900e8e0a4e0ea1f4f8d2ee33e4753d2119bc122f94ecafc660b46c0511@buzz.block.builderlab.xyz>