fix(status-notices): align warning icons in startup safety notices

[chioarub]

Summary

• Add a shared WarningNoticeRow for startup status notices so warning icons have a stable gap before text and wrapped lines align under the message column.
• Reformat the two permission safety warnings into a concise headline plus dim supporting detail.
• Add render regression coverage for the bypassPermissions and --dangerously-skip-permissions notices at an 80-column width.

Why

The permission safety warnings could render as ⚠bypassPermissions or ⚠--dangerously-skip-permissions, which made high-risk startup notices look cramped and less polished. Centralizing the warning row layout fixes the immediate spacing issue and prevents the same icon/text adjacency problem across other warning notices.

Validation

• bun install --frozen-lockfile
• bun install --cwd web --frozen-lockfile
• bun run smoke
• env -u CLAUDE_CODE_USE_OPENAI -u OPENAI_MODEL -u OPENAI_BASE_URL -u OPENAI_API_BASE -u OPENAI_API_KEY -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GEMINI_ACCESS_TOKEN -u GOOGLE_APPLICATION_CREDENTIALS -u GOOGLE_CLOUD_PROJECT -u GCLOUD_PROJECT -u MIMO_API_KEY -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN HOME="$CI_HOME" METADATA_SERVER_DETECTION=none bun test --max-concurrency=1 (3015 pass, 0 fail)
• python -m pip install -r python/requirements.txt && python -m pytest -q python/tests (44 passed)
• bun run security:pr-scan -- --base origin/main
• env -u CLAUDE_CODE_USE_OPENAI -u OPENAI_MODEL -u OPENAI_BASE_URL -u OPENAI_API_BASE -u OPENAI_API_KEY -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GEMINI_ACCESS_TOKEN -u GOOGLE_APPLICATION_CREDENTIALS -u GOOGLE_CLOUD_PROJECT -u GCLOUD_PROJECT -u MIMO_API_KEY -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN METADATA_SERVER_DETECTION=none bun run test:provider (609 pass, 0 fail)
• env -u CLAUDE_CODE_USE_OPENAI -u OPENAI_MODEL -u OPENAI_BASE_URL -u OPENAI_API_BASE -u OPENAI_API_KEY -u GEMINI_API_KEY -u GOOGLE_API_KEY -u GEMINI_ACCESS_TOKEN -u GOOGLE_APPLICATION_CREDENTIALS -u GOOGLE_CLOUD_PROJECT -u GCLOUD_PROJECT -u MIMO_API_KEY -u ANTHROPIC_API_KEY -u ANTHROPIC_AUTH_TOKEN METADATA_SERVER_DETECTION=none npm run test:provider-recommendation (78 pass, 0 fail)
• bun run --cwd web typecheck && bun run --cwd web build

Note: the full Bun suite was run with provider credentials unset and metadata probing disabled to match CI more closely; the local shell has provider and Google ADC state that changes unrelated tests.