feat(waybar,nvim): update-staleness reminder; nvim update visible

Two related changes around the 'just update' UX:

1. nvim-update no longer runs --headless. The diff buffer that
   vim.pack.update opens *is* the per-plugin changelog, and that was
   being thrown away under headless. Drop --headless from the justfile
   recipe and the trailing :qa! from config.update.run() so the buffer
   stays open until the user reviews and quits manually. Mason output
   was already visible because mason-tool-installer print()s.

2. New waybar 'custom/update' module + matching mako notification as a
   gentle staleness reminder, replacing any temptation to run
   unattended pacman -Syu (a bad idea on Arch: rolling, news-driven
   manual interventions, AUR rebuilds, partial-upgrade hazards).

   Source of truth: /var/log/pacman.log — last '[PACMAN] starting full
   system upgrade'. No daemon, no -Sy poll, no extra state file beyond
   a per-session notify-throttle stamp in $XDG_RUNTIME_DIR.

   Tiers (hours since last full upgrade):
     <  24h   hidden   (":empty" via #custom-update.fresh padding 0)
     24-168h  yellow   + normal-urgency mako, throttled to 1/24h
     >= 168h  red      + critical-urgency mako, throttled to 1/24h

   Click runs 'just update' in a floating ghostty.

3 files changed, 103 insertions, 0 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index 95aa17e..a6614f9 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -20,6 +20,7 @@
     "bluetooth",
     "idle_inhibitor",
     "custom/notifications",
+    "custom/update",
     "custom/thunderbird",
     "clock",
     "tray",
@@ -210,6 +211,14 @@
     "tooltip": true,
   },
 
+  "custom/update": {
+    "exec": "~/.config/waybar/update-status.sh",
+    "return-type": "json",
+    "interval": 60,
+    "on-click": "ghostty --class=floating -e sh -c 'cd ~/dotfiles && just update; printf \"\\n[done — press enter] \"; read _'",
+    "tooltip": true,
+  },
+
   "custom/thunderbird": {
     "exec": "~/.config/waybar/tb-unread.sh",
     "return-type": "json",
diff --git a/dot_config/waybar/executable_update-status.sh b/dot_config/waybar/executable_update-status.sh
new file mode 100755
index 0000000..471116f
--- /dev/null
+++ b/dot_config/waybar/executable_update-status.sh
@@ -0,0 +1,81 @@
+#!/bin/sh
+# Waybar custom/update: gentle reminder that the system hasn't been
+# upgraded recently. Source of truth is /var/log/pacman.log — the last
+# "[PACMAN] starting full system upgrade" entry. No daemon, no -Sy
+# polling, no opinion about *which* updates are pending; this only
+# tracks whether you've run `paru -Syu` (or equivalent) lately.
+#
+# States, by hours since last full upgrade:
+#   < 24h         empty (hidden via :empty rule in style.css)
+#   24h – 168h    warn      → yellow icon  + normal-urgency mako once/24h
+#   ≥ 168h (7d)  critical  → red icon     + critical mako once/24h
+#
+# The mako notification is throttled by a stamp file in $XDG_RUNTIME_DIR
+# so reboots reset it (post-reboot is a fine moment to be reminded).
+
+set -eu
+
+LOG=/var/log/pacman.log
+STATE=${XDG_RUNTIME_DIR:-/tmp}/waybar-update-notified
+
+emit_empty() {
+  printf '{"text":"","class":"fresh","tooltip":""}\n'
+  exit 0
+}
+
+[ -r "$LOG" ] || emit_empty
+
+# Pacman log lines look like: [2026-05-07T08:30:00+0000] [PACMAN] starting full system upgrade
+last=$(grep -F '[PACMAN] starting full system upgrade' "$LOG" \
+  | tail -n1 \
+  | sed -n 's/^\[\([^]]*\)\].*/\1/p')
+[ -n "$last" ] || emit_empty
+
+last_epoch=$(date -d "$last" +%s 2>/dev/null) || emit_empty
+now=$(date +%s)
+elapsed=$(( now - last_epoch ))
+hours=$(( elapsed / 3600 ))
+days=$(( hours / 24 ))
+
+[ "$hours" -lt 24 ] && emit_empty
+
+# Tier + human-friendly duration
+if [ "$days" -ge 7 ]; then
+  state=critical
+  urgency=critical
+else
+  state=warn
+  urgency=normal
+fi
+
+if [ "$days" -ge 2 ]; then
+  ago="${days}d"
+elif [ "$days" -ge 1 ]; then
+  ago="1d"
+else
+  ago="${hours}h"
+fi
+
+text="󰚰 ${ago}"
+tooltip="System upgrade last ran ${ago} ago — click to run \`just update\`"
+printf '{"text":"%s","class":"%s","tooltip":"%s"}\n' "$text" "$state" "$tooltip"
+
+# Throttle mako: at most one reminder per 24h.
+last_notified=0
+if [ -f "$STATE" ]; then
+  last_notified=$(cat "$STATE" 2>/dev/null || printf 0)
+  case "$last_notified" in
+    ''|*[!0-9]*) last_notified=0 ;;
+  esac
+fi
+
+if [ $(( now - last_notified )) -ge 86400 ] \
+  && command -v notify-send >/dev/null 2>&1; then
+  notify-send \
+    --app-name=system-update \
+    --urgency="$urgency" \
+    --icon=system-software-update \
+    "System upgrade reminder" \
+    "Last upgrade: ${ago} ago. Run \`just update\` when convenient."
+  printf '%s\n' "$now" >"$STATE"
+fi
diff --git a/dot_config/waybar/style.css b/dot_config/waybar/style.css
index 4866f11..cb4dd86 100644
--- a/dot_config/waybar/style.css
+++ b/dot_config/waybar/style.css
@@ -60,10 +60,23 @@ window#waybar {
 #custom-webcam,
 #custom-dock,
 #custom-notifications,
+#custom-update,
 #custom-thunderbird {
   padding: 0 6px;
 }
 
+#custom-update.fresh {
+  padding: 0;
+}
+
+#custom-update.warn {
+  color: #fabd2f; /* yellow — stale 24h–7d */
+}
+
+#custom-update.critical {
+  color: #fb4934; /* red — stale ≥ 7d */
+}
+
 #cpu {
   color: #83a598; /* blue */
 }