Adopt lifecycle-safe Connect beta.32 authority recovery

[callumalpass]

What changed

• pin TaskNotes to the exact Connect beta.32 artifacts from commit e1c1f49cca00bbae51e7f1d9ffb5e05c576bb753
• recover create/update/delete mutations by durable request ID after ambiguous authority outcomes
• bind authority work to UI lifecycle and cancel stale in-flight reads
• add real authority response-loss dogfood coverage
• add Android notification-channel, FCM, live-push, and restart smoke coverage
• exercise beta.32 transactional authorization in the dogfood flow

Why

TaskNotes must treat mdbase as the sole durable authority. Network loss, reload, or component unmount must not create a second task, resurrect stale UI work, or introduce an app-owned offline replica.

Impact

Drafts remain recoverable, committed mutations reconcile exactly once, stale authority reads are bounded by lifecycle, and Android notification delivery uses the production adapter.

Validation

• full verify: 352 tests with coverage
• 4,983 conformance cases (4,982 passed, 1 skipped)
• mdbase oracle, manifest validation, and production build
• pnpm test:e2e: 8 passed across desktop and mobile
• pnpm test:e2e:connect: exactly one task after deliberately dropping every create response
• Android Gradle unit tests, lint, and debug assembly
• emulator smoke: notification channel, real FCM registration, live opaque foreground push, and process restart
• central consumer artifact integrity check passed