v4.8.0

Telegram notifications + routing rules

The gateway's new operator notification channel, now on every client surface:

• SDK: notifications.channels.connectTelegram()/list()/revokeTelegram() + notifications.rules.list/create/update/delete (typed PATCH null-vs-absent semantics), and testNotification({source?, eventType?}) returning per-destination telegram.destinations[].
• CLI: run402 notifications channels connect telegram (prints the t.me deep link, polls to active), channels list/revoke, rules add/list/rm, notifications test --source/--type. Help text teaches the rule model: dimensions AND together, absent = wildcard, one rule → one chat, no rules = no Telegram traffic, the mandatory email floor is untouchable.
• MCP: list_notification_channels, list_notification_rules, create_notification_rule, delete_notification_rule; test_notification gains source/event_type params.
• CLI fix: the flat notifications/webhook-secret subcommands now short-circuit --help without hitting auth (with help-contract test coverage).

Note: the channel is fail-closed server-side (503 TELEGRAM_CHANNEL_NOT_CONFIGURED) until the platform's notification bot is provisioned. Binding is a deep-link tap — no bot tokens ever touch your config.

Tracking: #503 · gateway change notification-channel-routing-telegram (deployed + live-verified)