feat(comms): P1 presence — minimal Synapse + fleet presence room + mosaic.presence heartbeat + liveness

Implements RFC-001 P1 (the first shippable slice): deterministic Matrix
presence/liveness on a single-instance dev Synapse.

- infra/matrix/: DEV Synapse (RFC-002 Mode B, federation OFF, self-signed TLS,
  enable_registration:false, appservice registration wired). Rendered from
  parameterized templates — zero hardcoded topology. .data is gitignored.
- packages/comms/: minimal MACP presence SDK — set presence, run the
  mosaic.presence heartbeat (seq + interval per RFC-001 §4.5), and a
  deterministic liveness reader (online/away/offline from heartbeat age, NOT
  native-presence-timeout). Liveness core written RED-FIRST. 19 vitest tests.
- tools/matrix-presence-harness/: minimal provisioner (registers >=3 agent
  MXIDs, creates the fleet presence room, joins them — reuses the existing
  @mosaicstack/appservice intent lib) + an E2E validation harness proving
  A2/A3/A4 against a real Synapse.
- eslint.config.mjs: register packages/comms/vitest.config.ts with the
  type-aware project service (same as other packages' vitest configs).

DEV-compose validated only; production deploy is a separate coordinated step
(deploy-holds respected).

Part of the comms-evolution program (RFC-001 P1)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

infra/matrix/appservice/mosaic-as.dev.yaml.tpl

@@ -0,0 +1,30 @@
+# ============================================================================
+# mosaic-as.dev.yaml.tpl — Mosaic Appservice registration (DEV)
+# ============================================================================
+#
+#   *** DEV-ONLY. The tokens below are throwaway placeholders rendered at
+#       bring-up by dev-up.sh. NEVER commit real hs_token/as_token — in
+#       production they are crown-jewel secrets held by the SecretBackend
+#       (RFC-001 §8, RFC-002 §4). ***
+#
+# This is the MINIMAL P1 registration: it declares the @agent-* user
+# namespace so the P1 provisioner can register a few virtual agent MXIDs and
+# carry heartbeats. It intentionally does NOT model the full P2 taxonomy /
+# token-minting appservice.
+#
+# Rendered by infra/matrix/dev-up.sh (envsubst -> .data/${MOSAIC_AS_ID}.yaml).
+# ----------------------------------------------------------------------------
+id: "${MOSAIC_AS_ID}"
+url: null                      # P1: provisioner drives the AS API directly; Synapse pushes no txns.
+as_token: "${MOSAIC_AS_TOKEN}"
+hs_token: "${MOSAIC_HS_TOKEN}"
+sender_localpart: "mosaic-as"
+rate_limited: false
+namespaces:
+  users:
+    - exclusive: true
+      regex: "@agent-.*:${MATRIX_SERVER_NAME}"
+  aliases:
+    - exclusive: false
+      regex: "#mosaic-.*:${MATRIX_SERVER_NAME}"
+  rooms: []