fix: make notification intents explicitly targeted

[Anthonyy232]

Summary

• give both notification tap intents an explicit package/class destination
• retain immutable PendingIntent flags
• resolve the high-severity CodeQL implicit-PendingIntent finding with an analyzer-visible explicit component

Validation

• testDebugUnitTest passed locally
• merge is gated on unit CI plus Actions and Java/Kotlin CodeQL analysis