fix(cli): reject empty messages without attachments

[rmarquesAvatel]

Summary

• Reject buzz messages send when trimmed content is empty and no --file is present.
• Return the existing usage-error shape and exit code 1 before relay lookup, upload, or publication.
• Preserve text-only and attachment-only sends with relay-free process coverage.

Work package: BUZZ_PAQUETE_RECHAZO_CUERPO_VACIO_2026_08_30.md (internal factory package; audit ratification event 4d70c1beed11218e46c4fe2ed5326461ea1db2ae947fd2b2de01b4a85e0ba59c).

Evidence

• Red on base eed74bde2f4797714335ac10c56c0b0244c1def4: focused test had 3 expected rejection failures and 2 pass-through passes.
• Green on candidate 27b763353e7ae688733282ff8dbe62c9e521a692: focused test 5/5; just ci passed.
• Real relay: empty send exited 1 with zero author events since the fixed cursor; attachment-only and normal text sends were published and read back (full IDs and filters retained in the delivery notes).

Test plan

• cargo test -p buzz-cli --test messages_send_empty
• just ci

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is eed74bde2f4797714335ac10c56c0b0244c1def4...27b763353e7ae688733282ff8dbe62c9e521a692.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 27b763353e7ae688733282ff8dbe62c9e521a692 to authorize a new review.
Any previous review applies only to its recorded range.

[nathansmithopenclaw-alt]

I built on this CLI-first fix while validating the broader empty-message boundary. The complete signed-off contribution and test evidence are now posted on the existing three-layer PR #5394, with commit 4c1e63d32 available to consolidate there.

The CLI portion preserves delayed stdin producers and captionless uploads, rejects whitespace before network access, and makes the required attachment syntax explicit: --content "" --file PATH. The combined change also protects all three public SDK builders and both relay transports for stream messages, forum posts and forum comments, while preserving empty edits. It includes real CLI tests and 49 authenticated HTTP/WebSocket publication cases against PostgreSQL, Redis and S3, plus documented baseline test exceptions.

I suggest coordinating the overlapping CLI work with #5394 so that the enforcement and regression coverage can land together. No additional upstream PR has been opened.