Mark Phase 3 (Spark Control) done; trim spec to live command contract

Shipped in Spark Control v0.21.0: status badge + Update/Restart/Stop-Start/Logs
tile. All three exit criteria confirmed. matrix-bridge needed no code change.

- AGENTS.md: Current state + ROADMAP Phase 3 -> DONE; Deploy switched scp -> git
  pull (Update button); D10 stamped; new Infra fact for the Spark->Gitea path and
  the load-bearing IdentitiesOnly ssh-config pin the Update button depends on.
- spark-control-integration.md: trimmed from dev spec to live contract (dropped
  sudo -iu fallback and dev-side scaffolding; folded in direct-as-modelo, the
  Gitea key gotcha, restart cadence, and the LAN-only HTTP API).
- README: dropped stale "pre-Phase 0" status; Setup reframed for a fresh install.

Deferred follow-up: badge reflects container liveness only, not Matrix
connectivity; HEALTHCHECK + {{.State.Health.Status}} is the matrix-bridge-side fix.

ROADMAP.md

@@ -32,17 +32,21 @@ after it.
 - **Exit (falsifiable):** 3 real uses across ≥2 rooms, correct repo every time, zero
   wrong-directory launches. *Met — owner-confirmed N=3 pass.*
 
-## Phase 3 — Spark Control integration — SPEC DRAFTED (2026-06-15), awaiting Spark Control dev
+## Phase 3 — Spark Control integration — DONE (2026-06-16)
 
 - Bot container status surfaced on the Spark Control dashboard.
 - One-click update (pull + restart) wired the same way Spark Control drives the Sparks today
   (SSH/commands behind a button).
 - **Exit (falsifiable):** bot status is visible and the bot can be updated/restarted from the
-  panel.
-- **Spec:** `docs/spark-control-integration.md` — the SSH command contract + one-time Spark
-  migration to a Gitea clone. Decided: update = git-pull-from-Gitea; Spark Control's existing
-  SSH into `spark-32d0` carries the buttons (no new key). matrix-bridge needs no code change;
-  remaining work is Spark Control-side + the one-time migration.
+  panel. *Met — shipped in Spark Control v0.21.0; all three controls confirmed working.*
+- **Shipped:** matrix-bridge tile (status badge + Update / Restart / Stop-Start / Logs) running
+  the spec's SSH commands; the Spark's `~/matrix-bridge` is now a Gitea clone tracking `master`.
+  matrix-bridge needed no code change. Deviation: Spark Control connects directly as `modelo` (no
+  `sudo` wrap — no passwordless sudo on this Spark). Live command contract + the Gitea key pin the
+  Update button depends on: `docs/spark-control-integration.md`.
+- **Deferred follow-up:** badge reflects container liveness only, not Matrix connectivity — a
+  Docker `HEALTHCHECK` (bot-side liveness signal) would let the tile read `{{.State.Health.Status}}`.
+  matrix-bridge-side change; do it if/when "running but silent" bites.
 
 ## Phase 4+ — Future direction (documented, not yet scoped to build)