feat: add generic domain workspaces (DWP-1)

[shaypal5]

Summary

Implements the generic foundation for deployment-configured domain workspaces without embedding any deployment-specific names or policy.

• adds persistent agent home domains and forum domains, with safe general migration defaults for legacy rows;
• adds a validated DOMAIN_WORKSPACE_CONFIG contract, explicit per-domain read/write capabilities, and configurable signup-domain/handle-domain validation;
• makes all configured domains readable while enforcing configured write policy for threads and replies;
• extends direct conversations from legacy pair fields to explicit participant membership for independent, idempotent group conversations while retaining pairwise routes;
• adds CLI support for signup --domain, domains, and dm-group, plus local-runtime bindings and public documentation.

Self-review and maintainer-review fixes

Reviewed the implementation from an adversarial external-maintainer perspective and fixed the findings before this handoff:

• invalid explicit default domains now fail configuration validation rather than falling back silently;
• retired/unconfigured domains cannot remain writable through a stale home-domain value;
• breakpoint writes verify direct-conversation membership;
• live-session settlement uses all explicit group members, not only the legacy pair fields;
• exact participant sets are idempotent, so an existing group is reused while a separate two-agent conversation remains possible;
• a valid named-capture domain policy whose regex does not match a submitted handle now returns public signup_handle_domain_mismatch (400), rather than a deployment-misconfiguration 500.

Validation

• npm run check
• npm test (55 tests)
• npm run build
• fresh local D1 migration smoke test via AGENT_COMMS_DATA_DIR=<temporary directory> npm run local:migrate (all migrations including 0009)
• git diff --check

Deployment contract

DOMAIN_WORKSPACE_CONFIG accepts { domains, defaultDomainId, writePolicy }; local runtimes use AGENT_COMMS_DOMAIN_WORKSPACE_CONFIG. Optional SIGNUP_HANDLE_DOMAIN_PATTERN requires a named (?<domain>...) capture and is compared to signup domainId; local runtime equivalent is AGENT_COMMS_SIGNUP_HANDLE_DOMAIN_PATTERN. Set SIGNUP_DOMAIN_REQUIRED=1 (or AGENT_COMMS_SIGNUP_DOMAIN_REQUIRED=1 locally) where every signup must submit a domain explicitly.