fix: macOS updater archives, AppImage GST registry, mesh max_tokens

[Chessing234]

Summary

• [Bug] macOS auto-update fails signature verification on Intel — both darwin arches share one unversioned Buzz.app.tar.gz in buzz-desktop-latest #2690: ship arch-specific macOS updater tarballs so Intel/arm64 stop clobbering each other
• [Linux/AppImage] Mixed GStreamer dependencies cause plugin failures, registry pollution, and unreliable audio on Ubuntu 26.04 #2560: keep AppImage GStreamer registry under ~/.cache/buzz/
• [Bug] Shared-compute agents can run green but never answer on small-context models because relay-mesh max_tokens override is clobbered #2558: seed relay-mesh env from user overrides before applying mesh defaults (spawn path)

Test plan

• cargo test --features mesh-llm --lib preserves_user_max_output
• cargo fmt --check, bash -n fix-appimage, YAML parse release.yml
• release assemble guard (CI)

Made with Cursor

[bokiko]

Thanks for the quick fix. I validated the #2558 part of this PR on an independent two-node shared-compute testbed (SmolLM2-135M served over relay-mesh, consumer agent with a per-agent BUZZ_AGENT_MAX_OUTPUT_TOKENS=1024).

Tested at PR head 5c1f22bde279bbdccf86ce55ae84a95bd5e56a91. What I confirmed:

• The per-agent BUZZ_AGENT_MAX_OUTPUT_TOKENS=1024 now reaches the spawned buzz-acp / buzz-agent (verified on their live process env). Previously the harness always ran 4096 — that clobber is gone.
• The prior failure is gone: no more 503 … all 0 tunnel(s) from the context fit check. Mesh requests succeed, and a direct completion through the same ingress at max_tokens=1024 returns 200.
• The added unit test (apply_relay_mesh_env_preserves_user_max_output_tokens) passes.

One caveat so I'm not overstating it: the agent did not post a full channel reply in my run. Inference succeeded (no 503), but SmolLM2-135M didn't produce a postable response — that looks like tiny-model/harness-quality behavior, separate from this PR's fix.

Net: the env-precedence change resolves the clobber and unblocks small-context shared-compute agents at the routing/sizing layer. Happy to run further checks on the testbed if useful.

[Chessing234]

nice, thanks for validating on the two-node mesh setup

[Chessing234]

Rebased onto latest main to pick up nostr 0.44.6 (RUSTSEC-2026-0216) and the file-size ratchet baseline. Local Desktop file-size check is clean against current main.

CI workflows are waiting on maintainer approval for this fork push — please Approve and run workflows when you can.

[Chessing234]

@tlongwell-block @wesbillman @wpfleger96 mind taking a look when you get a chance?

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 59328d5ae38a51a618dd2fddd7faf1343d42096f...c865c3343843f27666ecb62953ba40a5a5b5ec99.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review c865c3343843f27666ecb62953ba40a5a5b5ec99 to authorize a new review.
Any previous review applies only to its recorded range.