Lockout notifications need a session path; systemd user services start with an
empty Environment, which made notify-send silently unreachable. Installer now
writes the current DISPLAY and the user-bus address (XDG runtime dir) into the
unit; deploy + daemon-reload + restart applied live and verified (7 listeners,
routed profiles answer 200).