refactor: invert safety->notifications via permission-notifier hook

notifications already depends on safety types (AmbientTranscript,
TranscriptStatus, record_permission_via_file), so safety is the lower
layer. safety previously owned a NotificationDispatcher just to fire one
permission-request notification, creating a back-edge into the higher
notifications layer.

Mirror the existing fallback-resolver/config-observer pattern: safety
exposes register_permission_notifier(fn) + a OnceLock hook, and the
notifications dispatcher is registered at cli::startup::run. safety no
longer constructs NotificationDispatcher.

Evicts safety from the dependency cycle (SCC 25 -> 24 modules). All 9
safety unit tests pass; check is clean.