Fix Gmail remote OAuth and complete host release experience

[gitcommit90]

Summary

• add a validated pasted-callback fallback for Gmail OAuth when authorization runs in a remote browser
• stop durable scheduled follow-ups at the tool boundary to prevent fabricated continuation replies
• add per-user global and channel notification sound controls
• finish the day-one host packaging/provisioning release contract and version 0.0.8

Gmail callback safety

• parses the complete failed 127.0.0.1 callback URL; never fetches it
• requires the exact generated loopback protocol, host, port, path, OAuth state, redirect URI, and PKCE verifier
• exchanges the code on the 1Helm host
• Captain/admin-only; rejects expired, reused, malformed, and mismatched callbacks

Verification

• npm run typecheck
• npm run build
• focused Gmail/notification/desktop tests: 10/10
• test/native-world.mjs: 116/116
• pre-rebase full npm test: 66 Node tests plus 116/116 native-world
• pre-rebase onboarding browser: 20/20
• git diff --check