feat(0144b): provision-agent-user.sh script idempotente + templates

Bash script que provisiona Matrix user via Synapse admin API + login para
access_token + scaffold completo (config.yaml, agent.go, prompts/system.md).
6 templates (user/sudo x config/agent.go/prompt). 20 tests bash pasan.
Genera .env con AGENT_<ID>_TOKEN/PASSWORD/PICKLE/DEVICE_ID + URL mesh.

dev-scripts/agent/templates/agent.sudo.go.tmpl

@@ -0,0 +1,42 @@
+// Package {{PACKAGE}} defines pure decision rules for the {{AGENT_ID}} bot.
+// Provisioned by dev-scripts/agent/provision-agent-user.sh (issue 0144b).
+//
+// Mode: sudo. Operates on {{HOST}} with root privileges. Every tool call
+// dispatches an approval request to #operator-approvals; without a 👍
+// from the operator in 60s the action fails.
+//
+// Tool registry is built by the runtime from cfg.DeviceMesh.ToolsAllowed.
+// All entries are scope=sudo or scope=both and the device_agent enforces
+// `requires_approval: true` on each.
+package {{PACKAGE}}
+
+import (
+	"github.com/enmanuel/agents/devagents"
+	"github.com/enmanuel/agents/pkg/decision"
+)
+
+func init() {
+	devagents.Register("{{AGENT_ID}}", Rules)
+}
+
+// Rules returns the decision rules for {{AGENT_ID}}.
+//
+// Triggers: direct messages, @mention, or delegated tasks from the user
+// agent (marker `[delegated from agent-{{HOST}}, correlation_id=...]`
+// detected by the runtime via decision.MessageContext.IsDelegated).
+// The LLM is responsible for refusing destructive payloads (rm -rf /,
+// libc/systemd uninstall, etc.) per the system prompt §3.
+func Rules() []decision.Rule {
+	return []decision.Rule{
+		{
+			Name: "llm-conversational-sudo",
+			Match: func(ctx decision.MessageContext) bool {
+				return ctx.IsDirectMsg || ctx.IsMention
+			},
+			Actions: []decision.Action{{
+				Kind: decision.ActionKindLLM,
+				LLM:  &decision.LLMAction{},
+			}},
+		},
+	}
+}