feat(comms): P1 presence — minimal Synapse + fleet presence room + mosaic.presence heartbeat + liveness

Implements RFC-001 P1 (the first shippable slice): deterministic Matrix
presence/liveness on a single-instance dev Synapse.

- infra/matrix/: DEV Synapse (RFC-002 Mode B, federation OFF, self-signed TLS,
  enable_registration:false, appservice registration wired). Rendered from
  parameterized templates — zero hardcoded topology. .data is gitignored.
- packages/comms/: minimal MACP presence SDK — set presence, run the
  mosaic.presence heartbeat (seq + interval per RFC-001 §4.5), and a
  deterministic liveness reader (online/away/offline from heartbeat age, NOT
  native-presence-timeout). Liveness core written RED-FIRST. 19 vitest tests.
- tools/matrix-presence-harness/: minimal provisioner (registers >=3 agent
  MXIDs, creates the fleet presence room, joins them — reuses the existing
  @mosaicstack/appservice intent lib) + an E2E validation harness proving
  A2/A3/A4 against a real Synapse.
- eslint.config.mjs: register packages/comms/vitest.config.ts with the
  type-aware project service (same as other packages' vitest configs).

DEV-compose validated only; production deploy is a separate coordinated step
(deploy-holds respected).

Part of the comms-evolution program (RFC-001 P1)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

infra/matrix/synapse/homeserver.dev.yaml.tpl

@@ -0,0 +1,84 @@
+# ============================================================================
+# homeserver.dev.yaml.tpl — Synapse DEV homeserver config (RFC-002 Mode B)
+# ============================================================================
+#
+#   *** DEV-ONLY. NOT FOR PRODUCTION. ***
+#
+# This is the RFC-001 P1 (presence) single-instance homeserver. It is
+# RFC-002 "Mode B — single-domain" (server_name == homeserver host), with
+# federation OFF (standalone), which is all P1 needs (RFC-002 §9 P1 row).
+#
+# NOTHING here is a production value. Every topology fact is a variable
+# rendered by dev-up.sh from the environment; there is no baked-in fleet
+# domain (RFC-002 G2 "zero hardcoded topology"). The secrets below are
+# throwaway DEV placeholders rendered at bring-up — never reuse them.
+#
+# Rendered by:  infra/matrix/dev-up.sh   (envsubst -> .data/homeserver.yaml)
+# Variables:    MATRIX_SERVER_NAME, MOSAIC_AS_ID (+ dev secrets)
+# ----------------------------------------------------------------------------
+
+server_name: "${MATRIX_SERVER_NAME}"
+pid_file: /data/homeserver.pid
+report_stats: false
+suppress_key_server_warning: true
+
+# --- Listeners -------------------------------------------------------------
+# 8008: plain HTTP (client + federation) for in-container/local tooling.
+# 8448: TLS (self-signed in DEV) — satisfies A1 "reachable over TLS".
+listeners:
+  - port: 8008
+    type: http
+    tls: false
+    bind_addresses: ['0.0.0.0']
+    x_forwarded: true
+    resources:
+      - names: [client, federation]
+        compress: false
+
+  - port: 8448
+    type: http
+    tls: true
+    bind_addresses: ['0.0.0.0']
+    resources:
+      - names: [client, federation]
+        compress: false
+
+# --- DEV TLS (self-signed; generated by dev-up.sh) -------------------------
+tls_certificate_path: "/data/dev-cert.pem"
+tls_private_key_path: "/data/dev-key.pem"
+
+# --- Store: sqlite is the simplest dev store (RFC-002 §1 allows it) --------
+database:
+  name: sqlite3
+  args:
+    database: /data/homeserver.db
+
+log_config: "/data/log.config"
+media_store_path: /data/media_store
+signing_key_path: "/data/${MATRIX_SERVER_NAME}.signing.key"
+
+# --- Hardening (RFC-001 §8 / RFC-002 §8.5), rendered so a dev gets it ------
+# Registration is OFF: agents come ONLY via the appservice (A1). AS user
+# registration bypasses this flag, which is exactly the design.
+enable_registration: false
+enable_registration_without_verification: false
+registration_shared_secret: "${SYNAPSE_REG_SHARED_SECRET}"
+macaroon_secret_key: "${SYNAPSE_MACAROON_SECRET}"
+form_secret: "${SYNAPSE_FORM_SECRET}"
+
+# Presence EDUs ON so Element shows the native dot for humans (RFC-001 §4.5);
+# the AUTHORITATIVE liveness is still the mosaic.presence heartbeat.
+presence:
+  enabled: true
+
+# --- Federation: OFF for P1 (standalone). Empty whitelist = federate with
+# nobody (RFC-002 §2.4 / NG5). No public-network federation. ----------------
+federation_domain_whitelist: []
+trusted_key_servers: []
+
+# --- Appservice registration wired in (A1). The file is rendered next to
+# this one by dev-up.sh. -----------------------------------------------------
+app_service_config_files:
+  - "/data/${MOSAIC_AS_ID}.yaml"
+
+# Keep default rate-limiting ON (RFC-001 §8). No overrides here.