feat(comms): P1 presence — minimal Synapse + fleet presence room + mosaic.presence heartbeat + liveness

Implements RFC-001 P1 (the first shippable slice): deterministic Matrix
presence/liveness on a single-instance dev Synapse.

- infra/matrix/: DEV Synapse (RFC-002 Mode B, federation OFF, self-signed TLS,
  enable_registration:false, appservice registration wired). Rendered from
  parameterized templates — zero hardcoded topology. .data is gitignored.
- packages/comms/: minimal MACP presence SDK — set presence, run the
  mosaic.presence heartbeat (seq + interval per RFC-001 §4.5), and a
  deterministic liveness reader (online/away/offline from heartbeat age, NOT
  native-presence-timeout). Liveness core written RED-FIRST. 19 vitest tests.
- tools/matrix-presence-harness/: minimal provisioner (registers >=3 agent
  MXIDs, creates the fleet presence room, joins them — reuses the existing
  @mosaicstack/appservice intent lib) + an E2E validation harness proving
  A2/A3/A4 against a real Synapse.
- eslint.config.mjs: register packages/comms/vitest.config.ts with the
  type-aware project service (same as other packages' vitest configs).

DEV-compose validated only; production deploy is a separate coordinated step
(deploy-holds respected).

Part of the comms-evolution program (RFC-001 P1)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

tools/matrix-presence-harness/README.md

@@ -0,0 +1,43 @@
+# tools/matrix-presence-harness — RFC-001 P1 validation (A1–A5)
+
+> **DEV-ONLY. LOCAL SANDBOX.** Drives the local `infra/matrix` Synapse only.
+> Never point it at live infra.
+
+The dev validation harness for the presence slice. It is the **minimal P1
+provisioner** + an end-to-end demo that proves the acceptance criteria against
+a real Synapse.
+
+## Pieces
+
+- `provision.ts` — the **minimal provisioner**: registers ≥3 agent MXIDs, creates
+  the fleet presence room, joins the agents. Reuses the existing tested
+  `@mosaicstack/appservice` intent library (register / createRoom / join). It is
+  deliberately **not** the P2 appservice (no auto-enroll / taxonomy / token minting).
+- `agent-proc.ts` — one presence agent as its **own OS process** (via
+  `@mosaicstack/comms`): joins the fleet room and heartbeats `mosaic.presence`.
+  Standalone so the harness can `SIGKILL` it for a true hard-kill (A3).
+- `validate.ts` — provisions, spawns the agents, then asserts:
+  - **A2** ≥3 agents show **online** in the fleet room.
+  - **A3** a `SIGKILL`'d agent flips to **offline within `dark_threshold`**,
+    deterministically (heartbeat-age based, not native-presence timeout), while
+    survivors stay online.
+  - **A4** prints the human-readable fleet liveness board.
+- `run.sh` — wires dev secrets + env and runs `validate.ts` over the self-signed
+  TLS endpoint (A1). Exits non-zero on any failed assertion.
+
+## Usage
+
+```bash
+../../infra/matrix/dev-up.sh     # bring Synapse up first
+./run.sh                         # provision + validate (A2/A3/A4)
+```
+
+Tunables (env): `HEARTBEAT_INTERVAL_MS` (1000), `MISS_TOLERANCE` (2),
+`DARK_THRESHOLD_MS` (6000), `AGENT_SLUGS` (`alpha,bravo,charlie`),
+`VICTIM_SLUG` (`charlie`), `MATRIX_CS_URL` (defaults to the TLS endpoint).
+
+## Note on `NODE_TLS_REJECT_UNAUTHORIZED=0`
+
+`run.sh` sets this **only** because the dev homeserver uses a self-signed cert.
+It is a dev convenience for exercising the SDK over TLS and must never be used
+against a real CA-issued endpoint.