fix(notifications): make scoped read writes atomic

[SadPossum]

Summary

• activate the Notifications CQRS transaction boundary by implementing ITransactionalUnitOfWork with an owned ReadCommitted relational transaction
• commit raw broadcast-read receipts, set-based history updates, and scope-state revisions atomically; clear tracked state after an owned rollback
• restrict relational mark-all updates to the exact admitted scope IDs in 500-scope batches, preventing a newly visible scope from being updated without a matching revision
• cover cancellation, explicit rollback, success, close-vs-write races, already-closed admission, duplicate receipt concurrency, and the 501-scope batch boundary on PostgreSQL and SQL Server

Why

The affected commands already declared transactional intent, but the module unit of work implemented only IUnitOfWork. Provider-native receipt inserts and ExecuteUpdateAsync therefore committed before the later scope-state SaveChangesAsync. Cancellation, save failure, or a concurrent scope close could leave read data committed without its corresponding scope revision.

Validation

• pwsh -NoProfile -File eng/verify.ps1
  • solution sync and module boundaries passed
  • build passed with 0 warnings and 0 errors
  • PostgreSQL and SQL Server migration drift checks passed
  • 131/131 non-Docker tests passed
  • 11/11 Docker integration tests passed
  • transitive vulnerability audit found no vulnerable packages
• repository security and release-evidence checks passed
• touched production files passed dotnet format --verify-no-changes
• independent exact-diff review found no P0/P1 issues

Scope

No public contracts, DI registrations, migrations, database model, or provider configuration change. Existing/non-relational transaction ownership continues to follow the current framework convention; host-owned outer transactions remain host-owned.