Add optional idempotent message ingress

[myobie]

Summary

• Add one optional --idempotency-key <KEY> to ordinary st2 message send.
• Store the key in the canonical normal-message frontmatter.
• Serialize keyed sends with a short recipient-local lock, search inbox before archive, and return the existing normal message for a retry.
• Create no second inbox entry and no second DING for a retry.
• Forget the key when the archived message is deleted, so a later send can create a new normal message.
• Keep ordinary sends byte-for-byte compatible and free of idempotency lock state.

Boundary

This is local one-filesystem idempotency for one resolved recipient. It does not claim global exactly-once delivery across hosts or partitions. The normal inbox and archive messages are the only durable key records. There is no permanent receipt directory, receipt object, source/event pair, CAS, scheduler, workflow, or adapter policy in this PR.

Behavior

1. Validate the optional key.
2. For a keyed send, acquire .message-idempotency.lock in the recipient inbox.
3. Search the inbox first and the sibling archive second.
4. If a matching message exists, return its canonical path without publishing or composing DING again.
5. Otherwise, publish one normal message atomically. The DING path runs only for that fresh canonical message.
6. Moving the message to archive preserves the retry result. Deleting it forgets the key.

Evidence

Exact head: 4e9019e7eb00d0a6eaf267360c6d6c8d6b009199

Merged base: 4262c195899d9e5cacf6c5ea0e792ca176d431e9

Diff: 5 files, +568/-6.

• cargo check --workspace --all-targets
• focused message unit tests: 14 passed
• cargo test --test message_cli -- --test-threads=1: 10 passed
• scoped lib + message_cli Clippy with warnings denied: passed
• rustfmt and git diff --check: passed
• cargo test --workspace --doc: passed
• full workspace/all-target remainder: passed with four inherited failures excluded
• hosted Nix: run 30834231627, job 91755367616 passed

All four excluded tests reproduce on exact merged base 4262c195899d9e5cacf6c5ea0e792ca176d431e9:

• tracked_product_surface_contains_only_native_names
• presentation_changes_patch_the_exact_live_pty_without_restarting_it
• managed_agents_do_not_inherit_launcher_no_color_unless_declared
• managed_agent_color_contract_crosses_systemd_scope

This PR remains draft and unmerged pending review.