notify loads its spec from an embedded manifest under crates/rhema-claw/tools; the Rust side keeps only the invoke half. The drift test pins the shipped set: the manifest loads against its builtin, the registry serves the manifest spec, and notify stays replay-unsafe - a resumed run must not re-send a notification.