feat(attention): add quiet reminders and clearer GitHub handoff

[tcballard]

What changed

• adds opt-in delayed notifications for persistent Needs-you states
• puts reminder controls in Settings with 1, 5, 15, and 30 minute delays
• posts at most one quiet reminder per waiting item and cancels it when the task changes, resolves, opens, snoozes, hides, or notifications are disabled
• keeps notification content privacy-safe and routes clicks only to the exact waiting task
• gives review and failing-CI items a brief, repository-aware menu-bar bloom
• opens failing CI directly on the pull request Checks page
• bumps v0.1.2 to build 5 and updates the product contract and README

Why

The menu bar should remain the primary surface, but a persistent waiting task can still be missed when the user is away from it. Reviews and failed CI also needed clearer context and a more direct handoff to the work that needs attention.

This keeps Meanwhile deliberately quiet: notifications are off by default, limited to Needs-you work, and only delivered after a fresh poll confirms the item is still waiting.

Safety and privacy

• notification permission is requested only after an explicit Settings action
• no prompt, project, repository, path, command, tool input, or raw session identifier is included in a notification
• bounded opaque receipts prevent repeat reminders across relaunches
• failed delivery retries use a 60-second backoff
• review and CI items never generate notifications

Validation

• 105 Swift tests pass with no failures
• packaged Meanwhile.app successfully with its nested helper
• strict deep code-sign verification passes
• packaged Info.plist reports v0.1.2 build 5
• final concurrency and routing review found no remaining blockers

Manual packaged-app checks

• Settings layout in light and dark appearances
• notification allow, deny, and limited-permission recovery
• foreground Notification Center banner/list behavior
• exact notification-click routing
• cancellation immediately before the reminder threshold
• review and CI six-second bloom appearance

Automated GUI launch was unavailable because the desktop runner reached its usage limit, so these checks remain explicit before marking the PR ready.