Expose push notification simulation (simctl push / adb broadcast)

[thymikee]

iOS simulators support xcrun simctl push <device> <bundle> payload.json and Android has adb shell am broadcast for simulating push notifications. Neither is currently exposed by agent-device.

For any app with notifications (which is most apps), there is no way to:

• Test onboarding permission prompts for notifications
• Test notification-driven navigation (tap notification → open specific screen)
• Verify badge counts or notification content

Proposal: Add a command (e.g. push or notification) that accepts device, app bundle/package, and a payload (file or inline JSON), and delegates to simctl push on iOS and the appropriate am broadcast on Android. Document payload shape for both platforms.

Acceptance criteria:

• iOS: push <bundle> <payload.json> (or inline payload) using simctl push
• Android: equivalent using adb broadcast for a test notification / custom intent
• Works in session context (uses session device)
• Docs and skill/README updated