Notify when my own Bots finish or fail a turn, with one Notifications switch

[Birfy]

Fixes #353 (first slice, owner decision 2026-10-20 option a). The rest of #353 (quiet hours, mute, waiting too long, per-trigger switches, merging repeats, friends'/team reminders) is tracked in #469.

What

• When one of my own Bots finishes or fails a turn while the window is in the background or shows another chat, FlyBot shows one system notification: Coder finished / Coder failed: <reason> (the group name as body for a group turn). Clicking it focuses the window and opens that chat or group. It carries no buttons and never approves, rejects or sends anything.
• Same rules as the existing approval notification (core/src/client/approval-notices.js): only if the OS already allows notifications (never asks), one per event (tag), nothing from before the window opened.
• Host: turns.js keeps the last 20 ended turns (endedView, process-local) and they ride live().work.ended; ownedLive keeps only the actor's own Bots. Left out: stopped, switched and retried turns, a friend's Bot, turns a friend started, hidden turns another Bot asked for, face-to-face / inbound-share rooms.
• Settings → General → Notifications switch (on by default, prefs.notifications), covering approval waiting too.

Test

• New tests in core/test/approval-notices.test.js (client rules, switch, host filter); authz.test.js (narrowing) and install.test.js (set-prefs).
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify: pass (core 1033, social 291, tree 80, timeline 80, scripts 88, interop 37, live-e2e 16; 0 failures).
• Not run: live Mac instances, real OS notifications in a desktop build.

Risk tier: T2 (estimate; the controller sets the label)

[Birfy]

Self-review: PASS
Tip SHA: 2d54af3
Ran:

• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify (core lint + arch-docs OK, plugin lint, build-client --check, ds-bot-patches check, core 1033 / social 291 / tree 80 / timeline 80 / scripts 88 / interop 37 / live-e2e 16 tests, 0 failures)
• node .github/scripts/changelog.mjs check (OK)
• CI at the tip: tests-ok, test, plugins (social/tree/timeline), package all green
• Diff reviewed against the owner design rules and the Proactive reminders 1/3: event reminders (approval waiting, failed, finished) in app and desktop #353 decision (option a): only my own Bots; a notification only opens the chat (no approve/reject/send, no buttons); never asks for OS permission; one per event via tag; one Notifications switch in Settings → General, on by default, covering approvals; quiet hours / waiting-too-long left out (Proactive reminders 1/3 follow-up: quiet hours, mute, waiting-too-long #469); English UI with zh entries; ownedLive narrows work.ended to the actor's own Bots.
  Not run:
• live Mac instances (3080/3081) and a desktop build showing real OS notifications
• smoke bench (dev/smoke.mjs)

[Birfy]

Self-review PASS (after merging main 465357e): merged origin/main into feat/353-finish-fail-notifications (merge commit 91d9eb8, no rebase, no force-push).

• patches/ds-bot/topics.json: I kept both sides' entries in topic 0001 (main's src/host/schedules.js and test/schedules.test.js, plus this PR's approval-notices.js and its test).
• Source files merged on their own: i18n.js, authz.js (work.ended filter next to main's changes), channel.js (ended and the notifications pref) and the docs. The diff against the old head 2d54af3 contains only main's Edit and pause scheduled tasks; document missed runs #474 changes.
• Generated files, following the AGENTS.md recipe: I took main's patches/ds-bot (with the merged topics.json), rebuilt core/client.js, then ran ds-bot-patches.mjs generate. check passes.
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify on Node 24 passed (core 1042/1042, all other suites pass). CI is green.

[Birfy]

Self-review PASS (after merging main c7898dd): merged origin/main (which now includes #472 Agent inbox) into feat/353-finish-fail-notifications (merge commit e9bf10f, no rebase, no force-push).

• The only conflict was in the generated patches/ds-bot/0008-client-bundle.patch. I took main's patches/ds-bot and kept the merged topics.json (main's entries plus this PR's approval-notices.js and its test). Then I rebuilt core/client.js and ran ds-bot-patches.mjs generate. check passes.
• i18n.js (inbox strings and notification strings), client.js and docs/subsystems/core-client.md merged on their own. The diff against the old head 91d9eb8 contains only main's Add Agent inbox step 1: Inbox row with Needs you / In progress / Done #472 changes.
• ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify on Node 24 passed (core 1057/1057, all other suites pass). CI is green, and the PR is MERGEABLE/CLEAN.