Now that I see this, an alternative answer is to use Workbench and do a describe on the profile sobject (albeit, less convenient than seeing it all laid out per the Salesforce Inspector)
I found them using the Salesforce Inspector Chrome Add-on on a profile in my org. I click on show all data (tooling api) and see the below which matches up well with what you already got:
permissionsenablenotifications - Send Outbound Messages.
permissionsemailtemplatemanagement - Manage Email Templates
permissionsemailadministration - Email Administration
Finally found a solution to this weird problem.
I was not able to subscribe because storage limit was exceeded in my Developer Org.
Max limit is 5.0 MB and in my Org it was showing 6.2 MB.
So i deleted around 1000 records to bring size below 5.0 MB.
You can find it under Setup > Storage Usage.
And then I was able to subscribe Reports again.
Got to learn ...
How to hide a component based on the profil ? Instead of 'Contains', is there a way to '!Contains', to 'Not Contains' ?
I was unable to find that way, so I cloned my page and assign depending on the profile -not that satisfying solution.
As pointed out by @davidreed - the user making the change must have a license assigned to the managed package. Any user, even without the managed package license, can query the FieldPermission object and see all records across all packages, but only users with an assigned license can make updates to FieldPermission records.
Removing the ManageHubConnections userpermissions metadata block under the Admin.profile allowed me to deploy successfully.