feat(notifications): add native host grants and bounded approval alerts

[promptclickrun]

What changes

Adds optional native-host notifications without requiring Loopdy Link chat pairing. The host receives narrowly scoped public sending grants, not APNs or tenant-wide credentials.

Explicit device grant + subscribed native session
  → supported completion / failure / approval observer
  → frozen encrypted event + durable retry journal
  → account service verifies exact host and recipient authority

• Authenticated plugin enrollment, readback, subscription and event-detail routes.
• Exact grant/profile/session/turn ownership, stable event IDs and fixed privacy-safe copy.
• Bounded tool-scoped approval attention via additive stock pre/post observers. Responses retire unsent alerts; restart drops stale attention; old completion-only grants do not gain approval authority.
• Canonical work readback, parent/child ownership, cancellation as neutral Stopped, and retained terminal updates.
• Existing legacy transport and voice observers remain in place. Managed completion suppression is recipient- and event-scoped.

Verification

• 73 focused Python tests passed in a temporary credential-free Hermes home, including registration, activity bridge, managed enrollment, approval lifecycle, frozen retries and retirement races.
• Real stock-Hermes native WebSocket integration passed with the candidate preinstalled in a disposable development home: a guarded fixture operation generated a native approval request, its exact request ID was denied with all=false, the fixture remained unchanged, the approval alert retired and completion was observed for the exact stored session.
• All external delivery was blocked during the stock-host probe. Cloud/relay and native-consumer tests are separately owned by the companion app change.
• Main-agent source review and diff checks completed. No GitHub Actions were run.

Draft / rollout limits

• This PR does not authorize installation, activation, restart or release. Normal first-time installation still encounters the host's scanner caution/review gate; the development fixture is not scanner-acceptance proof.
• Companion account/relay code and mobile trust/enrollment support must land coherently before enabling this path.
• No real APNs delivery is claimed. An already admitted push cannot be recalled; copy says only that approval was requested. The app must reconcile the actual native prompt before any response.
• Approval attention is tool-scoped and conservative across producer lifetimes. Background native clarification and new scheduled-job subscriptions are not implemented here.
• Canonical running work is not reconstructed from stale persisted starts after a process restart.