rewrite(matrix): integration with end to end encryption support

[sibbl]

Refactor the matrix integration to utilize the matrix-bot-sdk, enabling end-to-end encryption and adhering to location, typing, and group concepts. Fix various room-related bugs in the process.

I decided not to enable end-to-end encryption by default, as it still comes with a few practical limitations for a bot like Clawdbot. In particular, encryption introduces additional operational complexity around key storage and recovery, requires explicit trust/verification from users, and can make debugging and observability significantly harder. There are also edge cases where bots miss messages or fail silently if keys aren’t shared correctly, which is a poor default experience.

[steipete]

Awesome, thanks! I take over. Some notes from codex review:

• BLOCKER: ESM require() in "type":"module" package → runtime crash.
  resolveCryptoStorePath/resolveStoragePath call require("node:os")/
  ("node:path"). extensions/matrix/src/matrix/client.ts:142.
• MAJOR: Thread replies dropped. sendMessageMatrix computes threadId
  then never uses it / no m.relates_to thread relation. Replies will
  post in main room. extensions/matrix/src/matrix/send.ts:502.
• MAJOR: Encrypted inbound media ignored. Only content.url handled;
  content.file never passed to downloadMatrixMedia, so E2EE
  attachments become text-only. extensions/matrix/src/matrix/monitor/
  index.ts:590.
• MEDIUM: Auto-join allowlist regression: alt_aliases no longer
  checked (only canonical alias). extensions/matrix/src/matrix/
  monitor/auto-join.ts:34.
• MEDIUM (risk): One-off clients (sendMessageMatrix w/o shared
  client) don’t crypto.prepare; E2EE rooms may look unencrypted or
  fail media encryption. extensions/matrix/src/matrix/send.ts:466.

Missing tests:

• E2EE inbound media via content.file decryption.
• Thread reply path (threadId → threaded send).

[steipete]

Landed via temp rebase onto main.

• Gate: pnpm lint && pnpm build && pnpm test
• Land commit: 627fa30
• Merge commit: 627fa30

Thanks @sibbl!

[steipete]

Landed follow-up fixes on main after rebase.

• Gate: pnpm lint && pnpm build && pnpm test
• Land commit: ${land_sha}
• Merge commit: ${merge_sha}

Thanks @sibbl!