feat(appservice): room provisioning via bridge API (M4c, agent-comms#9)

POST /bridge/v1/provision/rooms (inside the authed bridge block): creates
rooms AS the appservice sender (PL 100 override), optional alias/topic/
invite/space. Space-link failures surface partial success (room_id +
space_linked:false + space_error) instead of orphaning the room behind an
exception (review blocker); invite list capped at 50 (review blocker:
amplification via stolen bridge token); alias length capped. 13+14 vitest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/mosaic/framework/defaults/AGENTS.md

@@ -34,7 +34,6 @@ At session start, additionally:
 10. Manual `docker build` / `docker push` for deployment is FORBIDDEN when CI/CD pipelines exist in the repository. CI is the ONLY canonical build path for container images.
 11. Before ANY build or deployment action, you MUST check for existing CI/CD pipeline configuration (`.woodpecker/`, `.woodpecker.yml`, `.github/workflows/`, etc.). If pipelines exist, use them — do not build locally.
 12. The mandatory intake procedure is NOT conditional on perceived task complexity. A "simple" commit-push-deploy task has the same procedural requirements as a multi-file feature. Skipping intake because a task "seems simple" is the most common framework violation.
-13. **Merge authority (coordinated work):** when a coordinator/orchestrator session is active for the work, the post-review MERGE GO-AHEAD is the coordinator's to give — once code has passed the required review gates, request the coordinator's go-ahead and merge on their confirmation; do NOT wait on the human owner personally. Solo (uncoordinated) delivery keeps the default: merge without routine confirmation per gates 2 and 9. A "No self-merge" note on a PR means no UNREVIEWED self-merge — it does not suspend coordinator-authorized merges. (Policy: Jason, 2026-06-11.)
 
 ## Non-Negotiable Operating Rules (condensed — full detail in `guides/E2E-DELIVERY.md`)
 

packages/mosaic/framework/guides/E2E-DELIVERY.md

@@ -88,11 +88,6 @@ For implementation work, you MUST run this cycle in order:
 
 ### Post-PR Hard Gate (Execute Sequentially, No Exceptions)
 
-> **Merge authority:** if a coordinator/orchestrator session is active for this
-> work, obtain the coordinator's merge go-ahead after review passes, then run
-> the gate (AGENTS.md hard gate "Merge authority"). Solo delivery proceeds
-> without asking.
-
 1. `~/.config/mosaic/tools/git/ci-queue-wait.sh --purpose merge -B main`
 2. `~/.config/mosaic/tools/git/pr-merge.sh -n <PR_NUMBER> -m squash`
 3. `~/.config/mosaic/tools/git/pr-ci-wait.sh -n <PR_NUMBER>`

packages/mosaic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mosaicstack/mosaic",
-  "version": "0.0.31",
+  "version": "0.0.30",
   "repository": {
     "type": "git",
     "url": "https://git.mosaicstack.dev/mosaicstack/stack.git",