feat(uno-q): resident-responder fast-path for the LED matrix (instant, no flash)

The agent now drives the matrix in <1s via the resident responder instead of
compiling+flashing a sketch (~95s). Pieces:

- matrix-relay/: a tiny container (python-apps-base) running relay.py — a
  TCP:9999 → RouterBridge relay. The ZeroClaw daemon runs on the host for
  hardware access, but the RouterBridge python binding (arduino.app_utils)
  only ships in the App Lab image, so JUST the relay runs containerized,
  mounting the router socket + publishing :9999 to loopback.
- config.template.toml: add matrix_pattern + matrix_text to the default risk
  profile's allowed_tools/auto_approve (the capability filter hides tools not
  listed — this was why matrix_text wasn't exposed to the agent).
- skills/led-matrix: lead with "use matrix_text / matrix_pattern first"; only
  flash for custom frames (flashing overwrites the responder). NOTE skills load
  from each agent's workspace copy, not shared/skills — push to all workspaces.
- provision-host-daemon.sh: flash the responder once + start the relay.

Proven on-hardware: "show a heart" and "scroll GO CLAWS" both instant via the
agent, no flash.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

deploy/uno-q/matrix-relay/run-relay.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# run-relay.sh — (re)start the matrix-relay container on the Uno Q host.
+# Runs the TCP:9999 → RouterBridge relay in a minimal container (the RouterBridge
+# python binding only ships in the App Lab image). Mounts the router socket,
+# publishes :9999 to loopback for the host ZeroClaw daemon's matrix tools.
+set -eu
+IMAGE="ghcr.io/arduino/app-bricks/python-apps-base:0.11.0"
+RELAY="${RELAY:-/home/arduino/matrix-relay/relay.py}"
+docker rm -f matrix-relay >/dev/null 2>&1 || true
+docker run -d --name matrix-relay --restart unless-stopped \
+  -v /run/arduino-router.sock:/var/run/arduino-router.sock \
+  -v "$RELAY":/relay.py:ro \
+  -p 127.0.0.1:9999:9999 \
+  --entrypoint python3 \
+  "$IMAGE" /relay.py
+echo "matrix-relay started (:9999 → RouterBridge)"