feat(notification): tell passengers what happened to their journey

[GODSCAR1]

Adds notification-service, which listens to booking.created.v1, payment.succeeded.v1 and checkin.completed.v1, composes the message and hands it to a channel. Nobody is actually told anything: no service here holds an email address, a phone number or a name, so the channel is a port whose adapter writes a log line, and every send is recorded with the moment the channel took it (ADR-017).

booking-service gains an outbox and publishes booking.created.v1. ADR-001 said it would never need one, because everything it could announce another service already knew; a booking having been made is the case that broke that, since only booking-service can say it. The service had no transaction machinery at all, and a BEFORE_COMMIT listener published outside a transaction does not run and does not say so.

payment.succeeded.v1 and payment.failed.v1 now carry the passenger. The alternatives were a synchronous call from inside the consumer, or remembering the booking from another topic with no ordering between them, and both are argued in ADR-018. Payment itself stores nothing new.

Fixes docker-compose: checkin-service was never given the broker address, so its outbox could not deliver outside the end-to-end stack. The check-in smoke script found it, which the e2e suite cannot: it builds its own stack and wires each service itself.

The smoke scripts now refuse a switch they do not declare, wait for the relay before reporting, print the reason behind a refusal, and stop when the stack is down instead of announcing a flight they never created. scripts/README.md records what they are for.