fix(cli): bind repositories to channels

[gerodcarf]

Summary

Adds buzz repos bind-channel --id <repo-id> --channel <channel-uuid> to bind a repository's push permissions to a channel. The channel binding is stored as a buzz-channel tag on the repository announcement event (NIP-33 replaceable).

Changes

• crates/buzz-cli/src/lib.rs: New ReposCmd::BindChannel variant with --id and --channel args.
• crates/buzz-cli/src/commands/repos.rs:
  • Generalized ProtectionChange → RepoAnnouncementChange to support both protection-rule updates and channel binding.
  • build_updated_repo_announcement now handles three change types: SetProtection, RemoveProtection, BindChannel.
  • Bind-channel replaces any prior buzz-channel tag (repo can be bound to exactly one channel at a time).
  • Fixed timestamp advancement: stale announcements now use now instead of existing.created_at + 1, keeping the timestamp inside the relay's ±15-minute admission window.
  • New test bind_channel_replaces_prior_binding_and_refreshes_stale_announcement.

Test plan

• cargo fmt -- --check — clean
• cargo clippy -p buzz-cli --lib — clean
• cargo test -p buzz-cli --lib — 251 passed, 0 failed
• Full just ci (requires desktop/mobile toolchain)

Originated from channel #PortPacket (f42893de-08c2-4507-88dc-8e440ee79396).