Integrate AgentTerm with SourceOS Agent Machine workspaces

[mdheller]

Context

AgentTerm should expose the operator-facing shell for SourceOS Agent Machine workspaces.

Target flow:

AgentTerm room -> Agent Registry resolution -> SourceOS Agent Machine profile -> Podman-backed workspace -> AgentPlane evidence.

Scope

Add an Agent Machine adapter and command surface:

/agent-machine doctor
/agent-machine init <profile> <repo>
/agent-machine attach <workspace>
/agent-machine run <tool> <workspace>
/agent-machine fingerprint <workspace>
/agent-machine evidence <workspace>

Requirements

• Preserve Matrix-first event log semantics.
• Resolve non-human participants through Agent Registry before dispatch.
• Treat Codex, Claude Code, Hermes, OpenCLAW/OpenClaw, local shell agents, and GitHub bots as governed participants.
• Record events for profile render, workspace attach, run request, policy decision, execution start, execution complete, evidence produced, and revocation.
• Governed execution should hand off to AgentPlane.
• Direct operator attach should be logged.
• Keep platform-specific Podman logic behind an adapter boundary.

Acceptance criteria

• Docs reference SourceOS Agent Machine.
• Stub commands may land first, but they must record governance-preserving events.
• Example event log includes an agent-machine lifecycle trace.
• No credentials or device-local private material are committed.

Non-goals

• Do not implement the Podman workspace engine here.
• Do not create another agent registry.
• Do not redefine AgentPlane evidence formats.