Keep relayed text out of notify-send's option parser

The argv click command closed injection through the hint's value, but the
sender still handed the headline and description to notify-send bare. A
value beginning with a dash is parsed there as flags, and one shaped like
`--hint=string:omarchy-exec-argv:[...]` is read as a hint of its own --
libnotify keys hints in a hash table, so the later of two replaces the
earlier and a forged headline outranks the vector --exec built.

That is reachable without any --exec in sight: omarchy-tailscale-send
passes a single file's basename verbatim as the description, so a file
named like the hint gives its click action to whoever chose the name.

Put the headline and description behind a `--` so notify-send reads them
as text, and refuse any pass-through word carrying omarchy-exec-argv --
--exec is the only thing that may build a click command.

Co-Authored-By: Codex XHigh <noreply@openai.com>

docs/notifications.md

@@ -127,6 +127,12 @@ and needs no notification to execute code. What is fully closed is untrusted
 *content* — web notifications can't set the exec hint at all, and any relayed
 title/filename is confined to inert argument data.
 
+The sender keeps that last part true rather than leaving it to each caller. The
+headline and description go to `notify-send` behind a `--`, so a relayed value
+beginning with a dash is text and not flags, and a word that reaches the
+pass-through option position carrying `omarchy-exec-argv` is refused outright:
+`--exec` is the only thing that may build a click command.
+
 ## Helper commands
 
 - `omarchy-notification-wait [timeout]` — polls until the shell answers IPC