feat(0144b): provision-agent-user.sh script idempotente + templates

Bash script que provisiona Matrix user via Synapse admin API + login para
access_token + scaffold completo (config.yaml, agent.go, prompts/system.md).
6 templates (user/sudo x config/agent.go/prompt). 20 tests bash pasan.
Genera .env con AGENT_<ID>_TOKEN/PASSWORD/PICKLE/DEVICE_ID + URL mesh.

dev-scripts/agent/templates/agent.user.go.tmpl

@@ -0,0 +1,41 @@
+// Package {{PACKAGE}} defines pure decision rules for the {{AGENT_ID}} bot.
+// Provisioned by dev-scripts/agent/provision-agent-user.sh (issue 0144b).
+//
+// Mode: user. Operates on {{HOST}} with operator's uid (no sudo).
+// Tool registry is built by the runtime from cfg.DeviceMesh.ToolsAllowed
+// (issue 0144a wires the LLM action to invoke devicemesh tools).
+package {{PACKAGE}}
+
+import (
+	"github.com/enmanuel/agents/devagents"
+	"github.com/enmanuel/agents/pkg/decision"
+)
+
+func init() {
+	devagents.Register("{{AGENT_ID}}", Rules)
+}
+
+// Rules returns the decision rules for {{AGENT_ID}}.
+//
+// Strategy: any DM or @mention triggers the LLM with tool_use. The LLM
+// decides which devicemesh tool to invoke (exec, fs.*, project.create,
+// delegate_sudo, ...). Tools are registered automatically by the runtime
+// from the cfg.DeviceMesh.ToolsAllowed slice — we do NOT enumerate them
+// here. See devagents/registry_build.go and pkg/tools/devicemesh/.
+//
+// Pure: zero I/O, zero side effects. The action emits []decision.Action,
+// the shell layer consumes it.
+func Rules() []decision.Rule {
+	return []decision.Rule{
+		{
+			Name: "llm-conversational",
+			Match: func(ctx decision.MessageContext) bool {
+				return ctx.IsDirectMsg || ctx.IsMention
+			},
+			Actions: []decision.Action{{
+				Kind: decision.ActionKindLLM,
+				LLM:  &decision.LLMAction{},
+			}},
+		},
+	}
+}