fix(desktop): enforce observer archive policy reconciliation on internal builds

[wpfleger96]

Summary

• On internal builds, observer archive reconciliation now unconditionally ensures kind 24200 exists in the owner_p DB subscription on every startup, regardless of stale localStorage markers ("0" or "1"). A prior opt-out can no longer suppress the observer archive — the DB row is authoritative for internal policy.
• OSS builds are a pure no-op — the reconciler returns immediately when the policy flag is off. The Settings toggle is the only mutation path for OSS users.
• Observer reconciliation is identity-scoped: changing pubkey resets readiness so the old ArchiveSyncManager tears down before the new identity's reconciliation completes. The gate is exposed as a pure isReconciledFor helper, directly unit-testable without React mount infra.
• Observer reconciliation runs eagerly (not behind useDeferredStartup) and must complete before ArchiveSyncManager opens relay listeners, closing the startup race where kind 24200 frames were permanently lost.
• Settings toggle uses tri-state policy (undefined = unresolved, true = locked, false = OSS): disabled while unresolved, fail-closed on flag error, OFF only when policy is positively known as OSS. checked reflects actual DB state, never synthesized from policy.
• Compiled-flag Rust test reads an independently supplied runtime expected value; desktop-tauri-test-compiled-flags Just recipe proves both clean (false) and internal (true) compiled states, wired into CI after desktop-tauri-test.
• Mock E2E bridge now supports observer_archive_default_enabled, agent_metric_archive_default_enabled, merge_save_subscription_kinds, and remove_save_subscription_kind. A Playwright spec covers Settings toggle states (unresolved/internal/OSS) and asserts archive sync reaches the subscription path post-reconciliation, exercising the real AppShell gate wiring; registered in the smoke project.

Related: buzz-releases#62 (PR pipeline env var parity + validation guard)

Changed files

File	Change
desktop/src/features/local-archive/useObserverArchiveSeed.ts	Reconciler: policy-on merges unconditionally, policy-off is a no-op. hasExplicitChoice removed from deps. Hook stores reconciledPubkey; identity-scoped readiness delegates to exported pure isReconciledFor.
desktop/src/features/local-archive/useObserverArchiveSeed.test.mjs	OSS tests assert zero merge + zero writes for all marker states; ordering test drives real ArchiveSyncManager + real reconciler with deferred promise; identity transition and rejection tests assert against the real exported isReconciledFor.
desktop/src/features/local-archive/ui/LocalArchiveSettingsCard.tsx	Tri-state policy (undefined/true/false). Toggle disabled while unresolved or policy-locked. Fail-closed on flag error. checked reflects actual DB state. Guard inside handleObserverToggle.
desktop/src/features/local-archive/archiveSyncManager.ts	Removed ready = true default on useArchiveSync — single caller must pass explicitly.
desktop/src/app/AppShell.tsx	Observer reconciliation runs eagerly; useArchiveSync gated on success. Metric seed stays deferred.
desktop/src/testing/e2eBridge.ts	Added bridge cases for observer_archive_default_enabled, agent_metric_archive_default_enabled, merge_save_subscription_kinds, remove_save_subscription_kind with configurable mock policy, plus an IPC call counter for list_save_subscriptions used by the E2E reconciliation-gate assertion.
desktop/tests/helpers/bridge.ts	Added observerArchiveDefaultEnabled mock option.
desktop/tests/e2e/observer-archive-policy.spec.ts	New spec: Settings toggle disabled/enabled/checked states across internal, OSS, and unresolved policy; reconciliation-gate test asserting list_save_subscriptions is reached only after successful reconciliation. Registered in playwright.config.ts's smoke project.
desktop/src-tauri/src/commands/observer_archive.rs	Updated comments to describe reconciliation/policy (not first-run seeding). Rust test is #[ignore]d and reads BUZZ_TEST_EXPECTED_OBSERVER_ARCHIVE_DEFAULT at runtime, panicking if unset, so it can't silently no-op.
desktop/src/shared/api/tauriArchive.ts	Updated observerArchiveDefaultEnabled docstring to describe policy enforcement (not auto-seeding).
Justfile	Added desktop-tauri-test-compiled-flags recipe, running the focused Rust test under both clean and internal-flag compilations.
.github/workflows/ci.yml	Wired desktop-tauri-test-compiled-flags into the desktop Tauri CI job after desktop-tauri-test.

[wesbillman]

The reconciliation ordering, identity-scoped gate, internal/OSS policy split, Settings tri-state behavior, and test coverage look correct. I found no code blocker. I am withholding approval because the head is currently 7 commits behind main; please rebase and rerun CI, then I can give the final approval against the current merge base.