Notifications: approvals, failures, and mentions as durable mail

[TheGreatAxios]

Summary

Route approvals, run failures, and mentions through a mail substrate with durable sink fan-out (not a parallel notification bus).

Test plan

• Notification delivery + sink fan-out tests
• Delivery authorization tests
• Migration applies cleanly on a fresh DB

[TheGreatAxios]

Self-critique (orchestrator, no sub-agent)

Verdict: needs-fix — package quality is high; composition root is missing

Looks good

• Domain lives in @corbits/notify (not apps/*).
• Parse-at-boundary with arktype (parseNotificationEvent); no cast of untrusted input.
• Mail-first design: durable record is mailbox; sink fan-out is post-commit dispatch rows.
• Delivery key uses \u0000 escape (not a literal NUL byte in source) — git-safe.
• Migrations wired via scripts/db-setup.ts.
• Solid tests: deliver, dispatcher, context, approval-bridge, migrations.
• Docs (docs/notifications.md) match the design.

Should-fix (merge blockers for a product PR)

1. No hub/apps wiring. Grep of apps/ shows zero imports of @corbits/notify / createNotifyDispatcher / deliverApprovalMail. Package is dead until the composition root mounts deliver + dispatcher. Either wire it in this PR or retitle/scope as "library only" and open a follow-up.
2. Confirm workspace resolution + CI green on rebased branch.
3. Greybeard + bruckheimer still required.

Nits

• Fresh install with zero sinks is correctly idle — good.
• Sink registration example in docs references @corbits/notify-sink-slack which does not exist yet — label as future example or drop the import path.

[TheGreatAxios]

Greybeard: MERGE — packages/notify durable sink fan-out; delivery authz; NUL key fixed. Non-blocking: drizzle schema omits unique() that migration has.