Remove --exec entirely; --exec-arg is the only click-command form

A free-form shell-string --exec sitting next to the safe --exec-arg is a
standing invitation for the next caller to interpolate untrusted data and
reintroduce the RCE. Remove it: omarchy-notification-send --exec now errors and
points at --exec-arg, and the shell drops the omarchy-exec string hint and its
bash -lc execution path, leaving only the argv path.

Migrate the remaining string callers (the first-run invitation hooks, wifi and
welcome prompts) to --exec-arg, and update their notification mocks. Trim the
verbose security comments added along the way.

bin/omarchy-crash-watch

@@ -33,10 +33,9 @@ announce() {
   omarchy-notification-wait || return 1
 
   # --exec-arg rather than a libnotify action: the shell runs clicks from its own
-  # omarchy-exec-argv hint and never emits ActionInvoked. Keeps the default
-  # "omarchy-action" app name too, the only one shouldBypassDnd() lets through.
-  # The argv form carries the crash details as literal arguments, so a hostile
-  # process name can't be reparsed as a command when the toast is clicked.
+  # hint and never emits ActionInvoked. Keeps the default "omarchy-action" app
+  # name, the only one shouldBypassDnd() lets through. Crash details ride as
+  # literal argv, so a hostile process name can't be reparsed as a command.
   omarchy-notification-send \
     --urgency critical \
     --glyph "$CRASH_GLYPH" \