Scaffold matrix-bridge (standards-compliant; pre-Phase 0)

Single-user Matrix -> Claude Code bridge bot, scaffolded from a prior scoping
package (SPEC/DECISIONS/CLAUDE/KICKOFF) folded into the current new-project scheme:
- AGENTS.md (canonical) with core flow, stack, placement table, condensed D1-D10
  decisions, sovereignty constraint, and Phase 0 as the first milestone
- CLAUDE.md -> AGENTS.md relative symlink; ROADMAP.md (Phases 1-4+, falsifiable exits)
- scripts/launch-claude.sh first-draft Mac wrapper (D4); config.example.toml
- canonical deny-by-default .gitignore + Python ignores

No bot code yet, by design: Phase 0 is manual-chain validation (N=3).

config.example.toml

@@ -0,0 +1,25 @@
+# matrix-bridge — room → repo mapping (EXAMPLE)
+#
+# Copy to config.toml (gitignored) and fill in real values during Phase 0.
+# The room you message in determines which repo the Claude Code session launches in —
+# routing is deterministic in v1 (decision D6). Adding a project is a config edit, not code.
+
+[homeserver]
+url = "https://<your-synapse-host>"        # existing StartOS Synapse, reached over WireGuard/LAN
+user = "@matrix-bridge-bot:<your-domain>"  # a dedicated bot Matrix account (not your own user)
+# Credentials (access token or password) come from the environment or a gitignored secret —
+# never commit them. The bot reads the homeserver URL + bot creds at startup.
+
+# One [[room]] block per project.
+#   room_id  — the internal Matrix room ID (starts with '!'), NOT the human alias (#name:domain)
+#   repo_dir — an absolute path on the Mac (note: ~/Projects uses a capital P)
+#   label    — human-readable name, for logs and error messages
+[[room]]
+room_id = "!exampleRoomId:your-domain"
+repo_dir = "/Users/macpro/Projects/recap"
+label = "recap"
+
+[[room]]
+room_id = "!anotherRoomId:your-domain"
+repo_dir = "/Users/macpro/Projects/spark-control"
+label = "spark-control"