feat(cli): add --require-mention fail-closed delivery assertion to messages send (#5010)

[yippietheproducer]

Fixes #5010.

Problem

buzz messages send had no way for a caller to assert that a recipient
actually ended up in the signed event. A send that notified nobody exited
0 with "accepted":true — byte-identical, at the exit-code level, to a
working send. The issue documents two independent automation scripts in one
deployment shipping the same wrong success signal (check exit code +
accepted:true only), with "mention_pubkeys":[] visible in their own
logs the whole time.

Fix

Adds --require-mention <hex|npub> (repeatable) to buzz messages send:

• After the event is built and signed, every required key must be
  present in the event's p-tags.
• The check runs BEFORE submit_event — a send that would notify
  nobody never publishes (fail-closed, matching the buzz mem opt-in
  shape the issue points at). Violation exits non-zero with the missing
  keys and the emitted mention set.
• The requirement is an assertion, not a mention: it does not count toward
  MENTION_CAP and does not alter the event.

Why before submit

Checking after publish would reproduce the exact failure mode in the
issue — the bad event is already out, the script alarms too late, and a
retry double-sends. Failing before publish gives automation a clean
non-zero exit it can retry safely.

Verification

• cargo check -p buzz-cli — clean
• Full buzz-cli suite: 325 passed, 0 failed (4 new tests: hex/npub
  normalization + dedup, no-cap, violation listing, and the signed-event
  p-tag read covering the exact silent-failure case from the issue)
• Help output smoke-tested: flag renders correctly