fix(service): fall back to elevated sidecar on path permission rejection

Preserve TUN settings and restore proxy operation after fallback.
Deliver fallback notices after UI subscription and stop retrying
deterministic bundle refusals. Publish fallback state atomically
and avoid conflicting service startup notifications.

src/types/generated/i18n-keys.ts

@@ -793,6 +793,7 @@ export const translationKeys = [
   'settings.feedback.notifications.clash.changeFailed',
   'settings.feedback.notifications.clash.geoDataUpdated',
   'settings.feedback.notifications.clashService.installSuccess',
+  'settings.feedback.notifications.clashService.sidecarFallback',
   'settings.feedback.notifications.clashService.uninstallSuccess',
   'settings.feedback.notifications.updater.withClashProxySuccess',
   'settings.feedback.notifications.updater.withClashProxyFailed',

src/types/generated/i18n-resources.ts

@@ -831,6 +831,7 @@ export interface TranslationResources {
           }
           clashService: {
             installSuccess: string
+            sidecarFallback: string
             uninstallSuccess: string
           }
           updater: {