feat(waybar,nvim): update-staleness reminder; nvim update visible

Two related changes around the 'just update' UX:

1. nvim-update no longer runs --headless. The diff buffer that
   vim.pack.update opens *is* the per-plugin changelog, and that was
   being thrown away under headless. Drop --headless from the justfile
   recipe and the trailing :qa! from config.update.run() so the buffer
   stays open until the user reviews and quits manually. Mason output
   was already visible because mason-tool-installer print()s.

2. New waybar 'custom/update' module + matching mako notification as a
   gentle staleness reminder, replacing any temptation to run
   unattended pacman -Syu (a bad idea on Arch: rolling, news-driven
   manual interventions, AUR rebuilds, partial-upgrade hazards).

   Source of truth: /var/log/pacman.log — last '[PACMAN] starting full
   system upgrade'. No daemon, no -Sy poll, no extra state file beyond
   a per-session notify-throttle stamp in $XDG_RUNTIME_DIR.

   Tiers (hours since last full upgrade):
     <  24h   hidden   (":empty" via #custom-update.fresh padding 0)
     24-168h  yellow   + normal-urgency mako, throttled to 1/24h
     >= 168h  red      + critical-urgency mako, throttled to 1/24h

   Click runs 'just update' in a floating ghostty.

1 files changed, 13 insertions, 0 deletions

diff --git a/dot_config/waybar/style.css b/dot_config/waybar/style.css
index 4866f11..cb4dd86 100644
--- a/dot_config/waybar/style.css
+++ b/dot_config/waybar/style.css
@@ -60,10 +60,23 @@ window#waybar {
 #custom-webcam,
 #custom-dock,
 #custom-notifications,
+#custom-update,
 #custom-thunderbird {
   padding: 0 6px;
 }
 
+#custom-update.fresh {
+  padding: 0;
+}
+
+#custom-update.warn {
+  color: #fabd2f; /* yellow — stale 24h–7d */
+}
+
+#custom-update.critical {
+  color: #fb4934; /* red — stale ≥ 7d */
+}
+
 #cpu {
   color: #83a598; /* blue */
 }