fix(devframe): publish approval notifications once per host

[dvcolomban]

Background (Why)

Opening two browser-control panels creates duplicate notifications because each page publishes into the same shared Devframe message feed. Each notification points to a command registered in only one page, so the other page cannot reliably use its action.

Changes (What)

Make the panel host publish one message per pending request or grant scope. Each page registers its own command under the shared message ID. Closing a page releases its commands without deleting the notification for other pages.

Keep description updates and removals serialized, including reconnect and disposal races. Preserve Review by default and configured direct Accept.

Verification (Testing)

The two-client regression fails before the fix and passes afterward. All 27 Devframe package tests, package/root test type checks, affected lint and the package build pass.

Real Chromium checks pass for embedded and standalone reference UI when using the upstream page-script correction in Devframe PR #387. They verify one shared message, page-local actions, closing either client and request removal. The new Chromium checks still fail against the pinned, unmodified hub UI, because its page scripts do not start before panel activation. This PR remains draft pending adoption of that upstream fix; no dependency upgrade or backport is included here.

[dvcolomban]

Superseded by #78, which incorporates the notification ownership behavior and regression coverage, upgrades to Devframe 1.0, and removes the temporary upstream patches that blocked this PR.