Run argv click actions through a login shell as positional params

Quickshell.execDetached(argv) ran the click target with only the shell
process's stripped environment, so GUI actions like the screenshot editor
(tensaku-edit) — resolved on the login-shell PATH the old `bash -lc` string
exec provided — stopped launching on click.

Run the argv through `bash -lc 'exec "$@"'` instead: the script text is a
constant and the arguments are passed as positional parameters, which bash
expands without re-tokenizing or re-evaluating, so injection safety is intact
while PATH and session env match the old behavior exactly.

shell/plugins/notifications/NotificationLogic.js

@@ -75,7 +75,8 @@ function execFromHints(hints) {
 
 // The click action as an argv vector, sent by omarchy-notification-send
 // --exec-arg and carried as a JSON array string in the omarchy-exec-argv hint.
-// The shell runs it with Quickshell.execDetached (no shell), so a value that an
+// The shell runs it via Util.execArgv, which passes the arguments as bash
+// positional parameters rather than interpolating them, so a value that an
 // attacker controls — a video title, a filename, a URL — is only ever one
 // argument and can never be reparsed as a command. This is the parameterized
 // form: the "prepared statement" to execFromHints's string concatenation.