Fix 429 (model pin) and bot ignoring encrypted admin replies

Two independent bugs:

1. 429 "long context" — agentic sessions read enough files to exceed the
   200K standard window; on the default [1m] model Synapse escalates into
   the paid 1M tier. Pin claude_model to claude-opus-4-8 (200K window)
   so Claude Code compacts context instead. Updated config.example.json
   and the maintainer.py default / comment accordingly.

2. Bot silently ignores operator replies — the DM room was created with
   is_direct:true, causing Element to auto-enable E2E encryption. This
   stdlib-only bot cannot decrypt m.room.encrypted events, so all admin
   messages were dropped without any log output. Fix:
   - register-matrix-bot.sh now creates rooms with is_direct:false and
     preset:private_chat (Synapse does not force encryption on non-DM
     rooms).
   - matrix_poll_admin() now logs a loud WARN if an encrypted event
     arrives, instead of silently skipping it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

register-matrix-bot.sh

@@ -140,10 +140,14 @@ joined = api(hs + "/_matrix/client/v3/joined_rooms", token=bot_token)[1].get("jo
 if room_id and not room_id.startswith("FILLED_BY_") and room_id in joined:
     print(f"→ Re-using existing room {room_id}")
 else:
+    # NB: is_direct must be False. A direct (DM) room makes Element auto-enable
+    # E2E encryption, which this stdlib-only bot cannot decrypt — it would then
+    # silently never see the operator's replies. A plain private room stays
+    # unencrypted (Synapse does not force room encryption).
     code, body = api(hs + "/_matrix/client/v3/createRoom", {
         "name": "Stack Maintenance",
-        "topic": "semprini-core autonomous stack maintenance",
-        "preset": "trusted_private_chat", "is_direct": True,
+        "topic": "semprini-core autonomous stack maintenance (unencrypted — bot is stdlib-only)",
+        "preset": "private_chat", "is_direct": False,
         "invite": [admin_id]}, token=bot_token)
     room_id = body.get("room_id")
     if not room_id: