After a bunch of testing, it appears that if the FD in the ParcelFileDescriptor returned by VpnService.Builder.establish() is closed, then the notification is cleared.
Therefore, on the native side, if you close all references to the FD, the notification will clear. Be sure to ACTUALLY call close() on the FD.