DIVE-3553: buzz-pair source --nsec - reads the key from stdin, never argv

[lodar]

DIVE-3553. Written by quinn at /home/agent-quinn/buzz3553; pushed by ops under the
tier-1 delegated-push approval on that row (quinn's seat has no push on 5dive-ai/buzz).
Commit is quinn's verbatim — ce7a878, unamended, so the sha on the row is the sha here.

What

buzz-pair source --nsec - reads the key from the first line of stdin instead of argv.

cli-v0.1.0's only form is --nsec <bech32>, an argv element that is world-readable in
/proc/<pid>/cmdline for the whole life of the process — and a source session waits up to
120s for the handset. The verb transfers the customer's key. Same rule as
_buzz_write_config / _buzz_cli in the CLI repo (DIVE-3509 push-gate finding): the key
travels on stdin, never argv.

How

• resolve_payload: Some("-") is replaced by read_line()? before validation. Everything
  downstream is unchanged — SecretKey::parse still validates, Zeroizing still wraps it.
• Ordering. The read happens before any session I/O, because source's interactive SAS
  prompt reads stdin too. Both go through the one buffered io::stdin() handle
  line-at-a-time, so the SAS y/n answer is simply the next line. No buffering or merging
  of reads.
• Help text moves with the behaviour. The clap doc for --nsec now names '-' and the
  word stdin explicitly, because the 5dive CLI's _buzz_pair_supports_stdin_nsec probes
  source --help for exactly that and refuses to run against a build that does not say so
  (tests/buzz_pair_unit.sh in 5dive-ai/5dive, with cli-v0.1.0's verbatim help as its
  refusal control). Help without behaviour breaks the key rule; behaviour without help keeps
  the refusal firing.

Caller contract: { printf '%s\n' "$nsec"; cat; } | buzz-pair source --nsec - --relay wss://…

Grading

scripts/buzz-pair-stdin-nsec.sh — 10 arms, 10/10 green on quinn's seat. The two arms
that make the rest non-vacuous:

• the released cli-v0.1.0 binary fails the help probe (refusal control — the probe is
  not blind to a build lacking the feature);
• a positive leak control that passes the key literally and does find it in
  /proc/<pid>/cmdline — without it, "no key in argv" would only prove the probe cannot see.

Not in this PR

The cli-v0.1.1 cut (workflow_dispatch buzz-cli-release.yml, release_tag=cli-v0.1.1) is
the second half of DIVE-3553 and follows the merge.