Remove --exec entirely; --exec-arg is the only click-command form

A free-form shell-string --exec sitting next to the safe --exec-arg is a
standing invitation for the next caller to interpolate untrusted data and
reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and
points at --exec-arg, and the shell drops the omarchy-exec string hint and its
bash -lc execution path, leaving only the argv path.

Migrate the remaining string callers (the first-run invitation hooks, wifi and
welcome prompts) to --exec-arg, and update their notification mocks. Trim the
verbose security comments added along the way.

bin/omarchy-chromium-ytdlp-host

@@ -27,7 +27,7 @@ valid_url() {
 
 # A printed path is only usable if it is a regular file inside DOWNLOAD_DIR.
 # Forged records (leading-dash mpv options, paths with control chars, or
-# anything that escaped the download directory) must not reach --exec.
+# anything that escaped the download directory) must not reach the click command.
 resolve_download_file() {
   local candidate=$1 file_real dir_real
 
@@ -70,9 +70,8 @@ title_from_file() {
   fi
 }
 
-# The click action is passed to the shell as an argv vector (--exec-arg), so the
-# path is one literal argument and never reaches a shell. `--` still guards mpv
-# itself against parsing a leading-dash filename as an option.
+# Click action as argv (--exec-arg): the path is one literal argument, and `--`
+# keeps mpv from parsing a leading-dash filename as an option.
 playback_exec_args=(--exec-arg mpv --exec-arg -- --exec-arg)
 
 # Drive the Quickshell OSD — a single overlay that updates in place (like the