Fix trigger matching and add network policies

- Trigger only matches when nick is at start of message, not mid-text
  Fixes: "coder: say hi to worker" no longer triggers worker
- Network policies per agent: "full" (default), "local" (LAN only), "none" (IRC+Ollama only)
  Configured via template "network" field, applied as iptables rules per agent IP

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agent/agent.py

@@ -365,11 +365,22 @@ def build_messages(question, channel):
 
 
 def should_trigger(text):
-    """Check if this message should trigger a response."""
+    """Check if this message should trigger a response.
+    Only triggers when nick is at the start of the message (e.g. 'worker: hello')
+    not when nick appears elsewhere (e.g. 'coder: say hi to worker')."""
     if RUNTIME["trigger"] == "all":
         return True
     lower = text.lower()
-    return NICK.lower() in lower or text.startswith("!ask ")
+    nick = NICK.lower()
+    # Match: "nick: ...", "nick, ...", "nick ...", "@nick ..."
+    return (
+        lower.startswith(f"{nick}:") or
+        lower.startswith(f"{nick},") or
+        lower.startswith(f"{nick} ") or
+        lower.startswith(f"@{nick}") or
+        lower == nick or
+        text.startswith("!ask ")
+    )
 
 
 def extract_question(text):