Merge dawn/k8s-provider: record full-launch wire fixture from desktop emitter

* dawn/k8s-provider:
  test(k8s): record the full-launch wire fixture from the desktop's emitter

Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>

* origin/dawn/k8s-provider:
  test(k8s): record the full-launch wire fixture from the desktop's emitter

Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>

crates/buzz-backend-kubernetes/tests/fixtures/provider-wire/README.md

@@ -8,10 +8,28 @@ Each `*.request.json` is a request the desktop can emit; each matching
 provider side is asserted by `tests/wire_fixtures.rs`; the desktop side should
 assert that its emitted payloads parse as the corresponding request.
 
-Two rules keep these useful rather than decorative:
+Three rules keep these useful rather than decorative:
 
 * **Requests are recorded, not invented.** A fixture that no caller emits
-  tests a contract nobody has.
+  tests a contract nobody has. "Recorded" means *executed and transcribed* —
+  `deploy-full-launch.request.json` is the output of the desktop's real
+  `build_launch_block` → `deploy_payload_json` path, not a shape derived by
+  reading those functions. Deriving it is how this fixture acquired four
+  impossible values at once: a `respond_to` that was a pubkey where the
+  desktop serializes a kebab-case `RespondTo` enum, allowlist and owner
+  values failing `validate_respond_to_allowlist`'s 64-hex rule
+  (`types.rs:897`), an invented `BUZZ_ACP_PARALLELISM` where the emitter
+  writes `BUZZ_ACP_AGENTS` (`runtime.rs:729`), and a `launch.env` key from
+  no layer of `resolve_effective_harness_descriptor`.
+* **The provider cannot police this file, so the desktop must.** Every field
+  above is one this provider is deliberately indifferent to — `respond_to` is
+  an opaque `Option<String>`, the allowlist an opaque `Vec<String>`,
+  `policy_env` an arbitrary map — so `the_full_desktop_payload_is_accepted`
+  passes on invented data exactly as happily as on recorded data. The
+  enforcement is the desktop's whole-object equality test, which *builds* the
+  payload and compares it to this file. A completeness guard (the case-list
+  directory scan in `wire_fixtures.rs`) stops a case from going missing; it
+  cannot tell you a case is false.
 * **Responses are byte-compared after key-sorted re-serialization**, so a
   field rename or a type change fails here rather than in a desktop that
   silently reads `undefined`.

crates/buzz-backend-kubernetes/tests/fixtures/provider-wire/deploy-full-launch.request.json

@@ -2,23 +2,48 @@
   "op": "deploy",
   "request_id": "req-6",
   "agent": {
-    "name": "worker",
-    "relay_url": "wss://relay.example",
-    "private_key_nsec": "nsec1vl029mgpspedva04g90vltkh6fvh240zqtv9k0t9af8935ke9laqsnlfe5",
+    "agent_args": [],
+    "agent_command": "goose",
     "auth_tag": "tag-1",
-    "respond_to": "npub1abc",
-    "respond_to_allowlist": ["npub1def", "npub1ghi"],
-    "env_vars": {"USER_KEY": "user-value"},
-    "model": "gpt-5",
-    "provider": "openai",
-    "turn_timeout_seconds": 300,
+    "env_vars": {
+      "USER_KEY": "user-value"
+    },
+    "idle_timeout_seconds": null,
     "launch": {
+      "args": [
+        "run",
+        "--session"
+      ],
       "command": "goose",
-      "args": ["run", "--session"],
-      "env": {"LAYERED": "from-launch"},
-      "policy_env": {"BUZZ_ACP_PARALLELISM": "10"},
-      "owner_pubkey": "beefcafe"
-    }
+      "env": {
+        "GOOSE_MODEL": "gpt-5",
+        "GOOSE_PROVIDER": "openai",
+        "USER_KEY": "user-value"
+      },
+      "owner_pubkey": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "policy_env": {
+        "BUZZ_ACP_AGENTS": "10",
+        "BUZZ_ACP_LAZY_POOL": "true",
+        "BUZZ_ACP_MODEL": "gpt-5",
+        "BUZZ_ACP_RELAY_OBSERVER": "true",
+        "BUZZ_ACP_SESSION_TITLE": "worker",
+        "GOOSE_MODE": "auto"
+      }
+    },
+    "max_turn_duration_seconds": null,
+    "model": "gpt-5",
+    "name": "worker",
+    "parallelism": 10,
+    "private_key_nsec": "nsec1vl029mgpspedva04g90vltkh6fvh240zqtv9k0t9af8935ke9laqsnlfe5",
+    "provider": "openai",
+    "relay_url": "wss://relay.example",
+    "respond_to": "allowlist",
+    "respond_to_allowlist": [
+      "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+    ],
+    "system_prompt": null,
+    "turn_timeout_seconds": 300
   },
   "provider_config": {
     "namespace": "buzz-agents-test",