Run notification click actions as argv, not shell strings

The click action of a notification was a free-form shell string run through
`bash -lc`, safe only when every sender shell-quoted every interpolated value
perfectly. One slip is RCE: a hostile yt-dlp video title forged an output
record and injected an mpv option into the click command (mehmetince.net RCE,
partially addressed by #7847).

Add a parameterized transport: omarchy-notification-send gains --exec-arg
(repeatable), encoding a JSON argv into the omarchy-exec-argv hint. The shell
runs it with Quickshell.execDetached(argv) and no shell, so data an attacker
controls is only ever one argument and can never be reparsed as a command. The
shell fails closed on a malformed argv hint.

The legacy free-form --exec string is retained but honored only from Omarchy's
own omarchy-action toasts, and deprecated. Migrate all in-repo callers
(screenshot, screen recording, taildrop receive, migrate-notify, crash-watch,
yt-dlp host) to --exec-arg. Update docs and tests.

shell/plugins/notifications/Service.qml

@@ -360,10 +360,25 @@ Item {
   function invokePopupDefault(index) {
     if (index < 0 || index >= popupModel.count) return
     var entry = popupModel.get(index)
+
+    // Preferred path: an argv vector run without a shell, so data an attacker
+    // controls (a video title, a filename) is only ever an argument and can
+    // never be reparsed as a command. Detached so it outlives the shell, which
+    // the installer toasts depend on: they restart the shell as their first act.
+    var argv = NotificationLogic.parseExecArgv(entry ? entry.execArgv : "")
+    if (argv) {
+      Util.execArgv(argv)
+      dismissPopup(index)
+      return
+    }
+
+    // Legacy free-form shell exec (deprecated). It runs through `bash -lc`, so
+    // it is only as safe as the sender's quoting — honored solely from
+    // Omarchy's own trusted toasts. app_name is spoofable, so this is a
+    // compatibility courtesy, not a security boundary; new callers use the argv
+    // form above.
     var command = entry ? String(entry.exec || "") : ""
-    if (command) {
-      // Detached so the launched command outlives the shell process, which the
-      // installer toasts depend on: they restart the shell as their first act.
+    if (command && String(entry.app || "") === "omarchy-action") {
       Util.execDetached(command)
       dismissPopup(index)
       return