fix(buzz-mcp): page channel reads past the relay limit - #1131

The channels tool queried only the newest 500 memberships and channel metadata events, hiding older accessible channels from listings and name searches. Discovery now pages through the relay while bounding both scanning and replies.

Change

• Scan memberships and metadata with the relay's until/before_id ordering, up to 10,000 events per stream plus a one-event exhaustion probe. Apply q while visiting metadata pages instead of retaining every event.
• Bound replies to 500 channel rows and 16,384 UTF-8 bytes, including the partial-result notice. Oversized details retain a usable ID when it fits.
• Return available results with explicit partial-result guidance at membership, metadata, or output limits. Exactly 10,000 scanned events can complete; more produces partial results rather than an overflow error. Transport failures still fail the call.
• Preserve joined-channel #d scope and relay access checks on every page. Membership checks use a Set. With all, IDs absent from an incomplete membership scan say membership unknown, not not joined.
• Refuse canvas reads and writes when neither an existing canvas nor visible channel metadata establishes the target. Visible channels without a canvas still return No canvas. Missing-metadata errors explain that the channel may not be visible yet; name-to-ID guidance is conditional on having supplied a name. Channel arguments remain IDs.

Verification

At 0951373deb08b3dde3ba2ef16bdcc60d206e83c6:

• MCP tests: 74 passed. Coverage includes discovery beyond 500 channels, same-timestamp cursor ordering, 9,999/10,000/10,001 events for both membership and metadata searches, no-match partial searches, joined scope, incomplete membership labels, 500/501 rows, and transport errors.
• MCP response tests cover the exact UTF-8 output boundary and adjacent bytes, plus long ASCII, multibyte, emoji, and escaped names. Existing-canvas reads skip metadata; writes wait past the current canvas timestamp; first writes require visible metadata before publication.
• Explicit pre-commit checks passed. Pre-push checks passed: TypeScript, 289 related tests across 13 files, design types and guards. Rust Clippy was skipped because no Rust inputs changed.
• A full Vitest run during the fix passed 9,021 tests and hit nine 5-second timeouts across six UI files (one test skipped). All six files then passed at this head with one worker: 186 tests, unchanged assertions and timeouts.
• Independent code review found no code defects; minimalness, elegance, and correctness each scored 9/10.

Earlier branch revisions were exercised through the bundled stdio MCP server against a local relay with ephemeral identities: a private channel older than 520 newer channels was found by name and opened by ID; a non-member could not discover or read it. Those runs predate this output-bound fix and do not validate the current reply limits.

Not exercised at this head: live relay behavior or the native in-app agent host. Hosted CI is tracked by the PR checks.