Add Matrix service backend seam

[mdheller]

Summary

Adds the first live-service seam for Matrix while keeping CI offline-safe.

This PR adds:

• matrix_service.py with MatrixServiceBackend protocol.
• MatrixSendRequest, MatrixSendResult, and MatrixSyncBatch models.
• InMemoryMatrixServiceBackend for CI/local development.
• NioMatrixServiceBackend with lazy optional matrix-nio import.
• MatrixServiceAdapter for matrix_service_send and matrix_sync events.
• build_matrix_service_backend(config) factory using AgentTerm config and AGENT_TERM_MATRIX_ACCESS_TOKEN instead of storing tokens in JSON.
• Policy Fabric treatment of matrix_service_send as side-effecting.
• agent-term-dispatch wiring for the Matrix service adapter.
• Tests for send request content, offline sends, sync normalization, service adapter send/sync, E2EE blocking, config factory behavior, and dispatch-level Matrix service send.

Boundary decisions

• Matrix remains the canonical transport.
• Matrix network I/O stays behind MatrixServiceBackend.
• matrix-nio is optional and imported lazily.
• Access tokens must come from environment variables, not JSON config.
• Matrix sends are side-effecting and require Policy Fabric admission.
• Sensitive Matrix sends still fail closed if E2EE posture is not acceptable.
• CI does not require a homeserver or Matrix credentials.

Validation

Expected CI:

ruff check .
pytest

Next lane after merge: add a small agent-term-matrix helper command for Matrix send/sync workflows, then add live sync-token/state handling.