feat: pin @attomus/semafore-crypto@^1.0.0 and wire final notify/execute paths

[attomus-gh]

Summary

• Pin @attomus/semafore-crypto as a runtime dependency using the requested ^1.0.0 range; lockfile resolves registry package 1.0.1.
• Replace notify scaffold failure with recipient resolution, real initSenderSession/encryptMessage envelope generation, and ADR-0166 notify/send request posting.
• Confirm execute actions still use service-token Authorization: Bearer ... and cover all three v1 routes.
• Rebuild bundled dist/ with crypto code inlined.

Contract note

The Action now calls /api/integrations/notify/recipients to resolve target recipients and key bundles before posting /api/integrations/notify/send. sf-server/main currently exposes notify/send but does not yet expose that service-token recipient/key-bundle resolution route; mobile recipient discovery/key-bundle lookup exists but is JWT-scoped. This PR wires the Action side to the narrow integration route it needs and records the server-side follow-up for Architect.

Validation

• npm install completed with no peer-dependency warnings.
• npm ls @attomus/semafore-crypto -> @attomus/semafore-crypto@1.0.1 from https://registry.npmjs.org/@attomus/semafore-crypto/-/semafore-crypto-1.0.1.tgz.
• npm run verify passed: lint, type-check, 4 test files / 10 tests, build, audit.
• gitleaks detect --no-banner -v --redact --report-format json --report-path /tmp/semafore-action-gitleaks-crypto.json -> 0 findings.

Bundle size

• Before: dist/index.js 1,071,809 bytes.
• After: dist/index.js 1,430,892 bytes.