fix(cli): read authenticated workflow run history

[p4jrj4b9nh-lab]

buzz workflows runs currently queries execution event kinds that the relay does not emit, so it can report [] without reading run history. Read the existing authenticated /workflows/{id}/runs endpoint instead and return its {runs, next} page. Add paired cursor flags, canonicalize UUIDs before signing the URL, and reject malformed responses instead of presenting empty history.

Preserve server 403 reasons without suggesting that callers remove their delegation credentials. This changes error reporting, not access control.

Validation: independent review of the five-file diff; all 469 CLI tests pass, including signed URL/header transport, UUID normalization, cursor/page validation, and isolated auth-tag-present GET/submit denial regressions. Full just ci passed (exit 0), including all lint/build/test gates and 2,076 Flutter tests. The passing run used CARGO_INCREMENTAL=0 RUST_TEST_THREADS=1 and omitted runtime pool-tuning variables only from the test subprocess. An earlier concurrent CI attempt recorded one existing connection-test failure; its standalone serial rerun and the full serial CI both passed. No source workaround was added. The passing CI tested base 44316ff72f5f7de014c66b01cbf534298a70c249 plus the reviewed diff; commit 5eaee904 contains that identical diff.

This is a CLI visibility fix. It does not repair scheduler firing, agent wake, provider authorization, or production RBAC. Deployment requires a CLI release plus an available relay history endpoint and existing least-privilege permission. Denied or unavailable endpoints remain explicit errors.

Related: #7065 (scheduler reconciliation), #7575 (trusted scoped authority). #3903 also includes workflow-history UI/relay/CLI work; this narrower contribution consumes the paginated endpoint already present on current main and adds no competing relay route. #7487 concerns startup policy reporting and remains separate.

Originating HQ instruction:
buzz://message?channel=57a6c2eb-fb42-46d7-a3c0-56b9fe0c03de&id=68ad56dfdd2919b3ccdca0cff47781e90a3fb48f361b6123db0727797613071a

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 813bbd14121edacc6cb4733301a3af12131aa10e...5eaee90481284d9edd7a5984d27065b3ed299ccb.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 5eaee90481284d9edd7a5984d27065b3ed299ccb to authorize a new review.
Any previous review applies only to its recorded range.

[p4jrj4b9nh-lab]

Current-base validation completed without expanding the five-file CLI diff. Local rebased head 1991c174c52785a225cc8b297e1d8a209f8df912 uses base 813bbd14121edacc6cb4733301a3af12131aa10e. GitHub merge result e4409c15efa87b8a75eeba344153c63e9e80a347 (current remote head 5eaee90481284d9edd7a5984d27065b3ed299ccb) has the identical tested tree 2e718ac9a1a6cdf18bafcb219b4b1e9469686ca1.

All 469 CLI tests passed. Full just ci passed its preceding formatting/lint/Rust/desktop/Tauri/build gates and failed its final mobile suite on one unchanged voice-note temporary-directory teardown (2,097 passed, one failed). The full flutter test rerun on the identical head passed all 2,098 tests. All required gates therefore have passing coverage across those invocations; the first full CI invocation itself exited 1. The cleanup-race cause remains unproven; no source workaround was added.

The exact-lease Git push of the rebase was denied with HTTP 403 for the configured contribution account, so the remote branch remains unchanged. No alternative account or branch-write mechanism was attempted.

@block/buzz-oss-team Please identify the accepting maintainer and supported branch-update/release path. Scheduler wake/run-read access remains separately tracked in #7065, and trusted authority in #7575. This PR only repairs CLI history visibility and denial reporting.

[p4jrj4b9nh-lab]

Overlap coordination update: nathansmithopenclaw-alt's comment on #3903 confirms this CLI-only direction and defers a competing CLI-history PR to #7577. This is contributor scope alignment, not maintainer acceptance or merge approval. The supported branch-update/release path remains unresolved; scheduler/read-access and trusted-authority dependencies remain separate in #7065 and #7575.