SDK bridge permission_request/notification handling hardened

The SDK bridge (the layer that lets an external host application talk to Claude Code) now handles a few edge cases more carefully:

• Errors while handling a permission request are now caught and logged instead of crashing unhandled.
• Notification messages whose method field isn't a string are now dropped with a warning instead of being passed through.
• Permission request messages are now validated with proper type checks on their tool_use_id and request_id fields, fixing what looks like a latent bug where the check referenced an undefined variable and so never worked as intended.