fix(MAT-258): blacklist unverified E2EE devices + add CI tests

Unverified devices (lacking cross-signing) caused OlmUnverifiedDeviceError
in _send_text(), silently breaking all message delivery. Now on_sync()
blacklists non-cross-signed devices instead of skipping them, and
_send_text() catches E2EE errors gracefully.

Adds 12 unit tests for device trust policy and send error handling.
CI test job now gates deployment in deploy.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -9,7 +9,19 @@ env:
   TARGET_VM: matrix.agiliton.internal
   DEPLOY_PATH: /opt/matrix-ai-agent
 jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install dependencies
+        run: pip install -r requirements.txt -r requirements-test.txt
+      - name: Run tests
+        run: pytest tests/ -v --cov=device_trust --cov-report=term
   build-and-deploy:
+    needs: [test]
     runs-on: ubuntu-latest
     steps:
       - name: Setup SSH
@@ -34,6 +46,16 @@ jobs:
           docker pull ${{ env.IMAGE }}:latest
           docker compose up -d --force-recreate --remove-orphans
           EOF
+      - name: Smoke test
+        run: |
+          ssh root@${{ env.TARGET_VM }} << 'EOF'
+          sleep 15
+          docker exec matrix-ai-agent-bot-1 python3 -c "
+          from bot import BOT_USER
+          print(f'Bot user: {BOT_USER}')
+          print('Smoke test passed')
+          " || exit 1
+          EOF
       - name: Cleanup
         if: always()
         run: docker builder prune -f --filter "until=24h" 2>/dev/null || true