fix(profile): merge kind:0 writes instead of replacing them

[bosoud]

Fixes #2534.

kind:0 is replaceable, so a profile built from a fixed set of keys is not a partial update — it deletes everything it did not build. build_profile constructed content from a 5-key allowlist, so bot, website, banner and lud16 were dropped the first time Buzz touched a profile that had them, silently and with exit 0.

bot is the expensive one: an agent that quietly loses its NIP-24 flag reads as a human account to every client that renders it.

Approach

buzz-sdk gains ProfileFields and merge_profile_content — a merge over the identity's current content that carries unknown keys forward, so a key from a future NIP also survives a Buzz write.

merge_profile_content is plain serde_json with no nostr types in its signature. That is deliberate: it crosses the nostr 0.36/0.37 boundary that forces desktop/src-tauri/src/events.rs to duplicate the SDK builders, so the duplicated profile-content logic is deleted rather than fixed in two places (item 5 of the issue). Desktop keeps only its own thin build_profile_merged wrapper for the 0.37 EventBuilder, and has no full-replacement variant left to call by accident.

The three write paths

CLI set-profile merges into the full fetched object instead of rebuilding five keys. That also removes the display_name → current.display_name → current.name fallback chain, which promoted a short handle into display_name for identities that had name but no display_name, and stops passing name: None on every write. New flags: --username (the NIP-01 name field), --website, --bot. --name still maps to display_name, so existing usage is unchanged.

Desktop update_profile and the deferred avatar save merge rather than rebuild from per-key fallbacks.

Desktop managed-agent sync now reads the agent's live profile and merges into it. This is the path the issue calls out as worst: it published a two-field event, and it is unattended — reached from agent save, model change, persona edit, persona and team snapshot import, profile reconciliation and managed-agent restore. AgentProfileInfo carries the full content object so the merge has a base. A failed or absent read degrades to an empty base, so a transient query error cannot block the sync.

Semantics

Unchanged for callers: None leaves a field alone; Some(v) sets it. Clearing a field is still not expressible — that needs a distinct "unset" signal and is deliberately left out of this change.

Tests

New in buzz-sdk, including the issue's exact repro (set one field, assert nothing else moved) with an unmodelled some_future_nip_key pinned to prove passthrough. New in desktop/src-tauri/src/relay.rs: the managed-agent sync preserves about/nip05/bot/website while updating name and avatar.

cargo test --workspace --lib and cargo clippy --workspace --all-targets are clean. The desktop Tauri crate type-checks clean (cargo check --tests, no warnings); I could not execute its test binaries locally because sherpa-onnx-sys has no prebuilt static lib for macOS x86_64, so CI is the first place those two desktop tests actually run.