Pre-release hardening

Agent-initiated push notifications: VAPID+subscriptions, /api/notify (rate-limited), service worker, PWA manifest+icons, Settings enable/test, environment-skill etiquette

Public template: auto-locks at runtime, shows duplicate-to-private widget