test(relay): adversarial multi-tenant isolation + ingest robustness battery

[s00ly]

What this is

An independent, wire-level verification of the relay's core security invariant —
all tenant-observable state under a URL is community-local — from two hostile
communities (a.localhost, b.localhost) sharing one relay process, one
Postgres, one Redis (the hosted multi-tenant shape). Blue-team framing:
every probe verifies a control is present and correct, anchored to
OWASP Top 10:2025 / CWE.

The team's conformance_multitenant suite is the obligation table; this
battery shares no helpers or assumptions with it, and deliberately re-probes
two lanes the table has todo!()-stubbed (event-id cross-fetch, DM fanout) —
a stub means unverified, not verified safe. Every probe is control-armed:
community A must observe the planted state, so a pass can never be faked by
the state simply not existing.

Probes (8)

#	Vector	Framework
P1	Event-id cross-tenant oracle (REQ {ids} + author scan from B)	CWE-200/668
P2	NIP-17 gift-wrap live fanout to same-key subscription on B	OWASP A01
P3	Mention (#p) query from B	CWE-668
P4	Blossom existence-oracle: B's error shape for A-hash vs never-hash	CWE-200
P7	Workflow webhook: A's UUID+secret fired at B; wrong-secret on A; correct on A	OWASP A01 / CWE-200
P8	POST /count bridge from B	CWE-668
P9	Same-coordinate (kind, author, d-tag) addressables in A and B	CWE-668
P10	Ingest-door hostile battery: truncated JSON, bad sig/id/kind/tags/pubkey, far-future created_at, 2MB content, empty shapes — all must 4xx, never 5xx, relay stays healthy	OWASP A05/A10, CWE-20

Evidence

Run against a local two-host deployment (setup in the file header):

• Every fence held. Notably P4: B 404s A's blob hash and a never-uploaded
  hash identically — the build is stricter than the shared-bytes option the
  conformance stub allows.
• 5× full 8/8 green runs; one additional run had a single unreproduced probe
  flake (suspected test-side timing in the live-fanout probe; no fence
  breach was observed in any run — flagging transparently rather than
  rounding to 100%).
• OPEN legs recorded in the file header (explicitly not green): git
  smart-HTTP pointer isolation (needs a real push fixture), raw-frame WS
  fuzzing, /moderation/audit (needs a community-admin fixture),
  approval-token row (blocked on WF-08 per the suite's own note).
• No cross-tenant leak and no remotely-triggerable 5xx found → no security
  disclosure triggered (per SECURITY.md).
• cargo fmt --check + cargo clippy -p buzz-test-client --all-targets -- -D warnings: clean.

Related note (no code change proposed here)

While establishing the baseline, nip11_relay_info::nip11_is_not_a_cross_community_enumeration_oracle
fails on current main: the A/B NIP-11 documents differ only in origin
(ws://<request-host>). origin echoes the caller's own host, so it cannot
enumerate other tenants — arguably not an oracle, and the test's
"identical apart from icon" invariant may be too strict. Two resolutions:
allowlist origin in the test with a rationale comment (my recommendation),
or relay-side normalize origin to the canonical relay URL. Happy to send
either as a follow-up — flagging here rather than bundling into this PR.

Composes with (does not overlap) #2268 and the gate-restore fix for
define_workflow sent separately.