feat(agent): add Maple (OpenSecret) provider

[benthecarman]

Summary

Adds Maple (OpenSecret) as a buzz-agent inference provider, and makes
model discovery provider-generic so the desktop picks up new providers
with no desktop-side discovery code.

• feat(agent): add provider-generic model discovery — catalog::discover_models is the one dispatch point behind both ACP session/new availableModels and a new buzz-agent models subcommand. Frontends stop carrying per-provider discovery knowledge; a provider added to the agent reaches every picker automatically. The subcommand builds its config without requiring a model, via a split of provider connection resolution out of Config::from_env.
• feat(desktop): discover models via agent binary — the desktop runs buzz-agent models before the ACP fallback when the runtime is buzz-agent. It needs no configured model, so draft configs in the create/edit dialog get live models too. Missing keys render through a generic config: <KEY>_API_KEY required matcher instead of per-provider copy.
• feat(agent): add Maple inference provider — requests travel through the opensecret SDK instead of a plain HTTPS POST: the enclave's AWS Nitro attestation document is verified against pinned PCR0 trust roots, an X25519 key exchange runs with the attested enclave, and request/response bodies are end-to-end encrypted. Inside the envelope the wire format is OpenAI Chat Completions, so the existing body builder and parser are reused unchanged. Retries follow post() with two deliberate differences: auth rejections fail immediately (a static key cannot mint a different token), and an attestation verification failure is terminal with an explicit "request not sent" message.
• feat(desktop): add Maple provider config UI — "Maple (encrypted)" entry in the persona provider picker with a Maple API Key credential field; the readiness mirror requires MAPLE_API_KEY plus a model, with MAPLE_MODEL as the provider-specific fallback.

Keyless discovery: the Maple enclave lists models for any attested
session, so a model picker can fill in before the user has entered a
key. Inference still requires the key.

Configuration: BUZZ_AGENT_PROVIDER=maple, MAPLE_API_KEY,
MAPLE_MODEL, MAPLE_BASE_URL (default
https://enclave.trymaple.ai), MAPLE_PCR0_ENVIRONMENT
(production | development, which PCR0 trust roots verify the
attestation).

Related issue

None found.

Testing

• just ci passes locally (fmt, clippy, unit + integration tests, desktop/web/mobile builds and tests).
• buzz-agent: Maple client construction (HTTPS enforcement for non-loopback hosts, keyless construction), SDK error retryability and terminal-error mapping, summary completion cap, and catalog filtering (audio, TTS, and embedding ids dropped). Full suite green.
• Desktop: readiness mirror tests cover Maple key/model requirements, including the MAPLE_MODEL fallback; buzz-agent models stdout parsing; frontend tests for the generic missing-key matcher.
• E2E (mock bridge): new maple-provider-ui screenshot spec covers the picker entry and the credential field. Screenshots posted in the comments below.
• Not exercised live: a real Maple enclave call needs a key I don't have. The attested transport is covered at the SDK boundary (error classification, retry, and terminal mapping) rather than end-to-end.

[benthecarman]

Maple in the provider picker

The persona provider picker lists "Maple (encrypted)" alongside the existing providers.

Maple selected

Selecting Maple swaps the credential field to a Maple API Key input. The model picker loads through the provider-generic buzz-agent models path, which works before a key is entered.