refactor(notifications): one notice classification, one config read, one diagnostic-metadata helper

- `is_diagnostic_notice()` replaces three drifting copies: the gateway muted every
  `credits.*` notice, the TUI and CLI only `warn`/`error`, so `credits.restored` was hidden
  on Telegram and shown in the TUI for the same config. Every credit-service notice is an
  automatic diagnostic (a "restored" line after a hidden depletion notice is orphan noise).
- `effective_user_config()` is the single fail-open effective-config read; the two extra
  `deepcopy`s per foreground turn go (the loader already returns a fresh copy and the
  snapshot is read-only).
- `diagnostic_metadata(event)` replaces the repeated
  `{"notification_category": "diagnostic"} if event.internal and ... else {}` literal in
  gateway/run_turn.py; the gateway-side imports of the resolver are module-level (no cycle:
  it imports only gateway.display_config).
- `display.suppress_warning_notifications` is listed with its sibling display keys in
  cli-config.yaml.example and the configuration reference; the messaging guide states that a
  muted diagnostic wake still runs (and bills) its agent turn.

cli-config.yaml.example

@@ -1798,6 +1798,14 @@ display:
   #   false: Only keep/send the final response
   interim_assistant_messages: true
 
+  # Opt-in: hide automatic warning/diagnostic notifications (compression, retry
+  # and fallback notices, credit/subagent failure lines, inactivity and watchdog
+  # stalls, media-delivery fallbacks, cron failure alerts) on this surface.
+  # Requested results, approvals, clarifications and command outcomes are never
+  # hidden, and nothing is removed from the logs. Per-platform override under
+  # display.platforms.<platform>.suppress_warning_notifications.
+  suppress_warning_notifications: false
+
   # Gateway-only long-running status heartbeats.
   # When false, the platform does not receive periodic "⏳ Working — N min"
   # notifications even if agent.gateway_notify_interval is non-zero. The