* refactor(notifications): isolate notification delivery

Move notification command construction, nonces, request tracking and timeout cleanup into a focused dispatcher. Keep notification policy, privacy, localization and memo persistence in the applet.

Update development ownership and regression coverage. User-visible behavior, settings, catalogs, README, usage guidance, changelog and parity TODO remain unchanged.

Validation: make check passed with 94 Python tests and 1,249 Qt checks, without failures or skips. Packaging, isolated install/upgrade, normal and private Plasma smoke scenarios, and notification argument/lifecycle tests passed.

* fix(notifications): bound dispatcher command text

Bound notification title and body before shell command construction and cover oversized inputs. Correct the lifecycle surface assertion to target the dispatcher's actual expiry call, and document the bounded command contract.\n\nValidation: make check passed with 94 Python tests and 1,191 Qt checks. Local QML import/type checks remained partial because Plasma type metadata is unavailable; GitHub CI provides the full KDE environment.