Update docs: Phase 1 bot status, run/deploy commands, headless-ask roadmap

- AGENTS.md: Commands now has the bot run/deploy (venv + scp from Mac); Layout lists
  src/bot.py, gui-launch.sh, requirements.txt, .env.example; Current state refreshed to
  Phase 1 (sub-steps 1-3 proven on the Spark; next = containerize).
- ROADMAP.md: log headless "ask" mode (claude -p -> output back into the room).

ROADMAP.md

@@ -54,3 +54,13 @@ after it.
   is actually in use.
 - **E2EE (D9).** Add matrix-nio end-to-end encryption (libolm) if the bot ever handles
   sensitive content over untrusted transport. Low priority while everything is WireGuard-local.
+- **Headless "ask" mode — return output into the chat (no interactive session).** Today a message
+  opens an interactive session surfaced to the phone. Add a mode where a message instead runs
+  `claude -p "<prompt>"` headlessly in the repo (full Claude Code context, but one-shot), captures
+  stdout, and posts the result back into the Matrix room — Matrix as a request/response interface,
+  not just a trigger. *Design notes:* `claude -p` (print mode) is exactly this capability. Likely
+  uses the long-lived OAuth token (Approach A / D11) so it runs over plain SSH with no GUI Terminal
+  and stdout is captured directly. *Open Qs:* how to select interactive-vs-ask (per-room? a prefix
+  like `?` / `/ask`? a dedicated room?); output-length handling (truncate / thread / attach file);
+  same local-only sovereignty constraints apply (output is the user's own; `claude -p` uses the
+  subscription, no frontier API on message payloads).