feat(notifications): bootstrap Hermes event audit

[selvalabs]

Summary

• Adds deterministic Hermes event audit primitives and user-facing intent/template guardrails.
• Documents ADR-002 and the Hermes bootstrap proposal for issue adr(notifications): design deterministic Hermes support agent #37.
• Updates agent handoff with branch status, validation, and next actions.

Scope

• No real WhatsApp, Telegram, webhook, deploy, credentials, or LLM calls.
• Does not alter PR feat(notifications): require admin approval #34.

Validation

• uv run ruff check .
• uv run mypy src
• uv run pytest
• migration validated with db-upgrade/db-current on temporary SQLite
• documentation checked for scope and secrets

Refs #37