feat(waybar,nvim): update-staleness reminder; nvim update visible

Two related changes around the 'just update' UX:

1. nvim-update no longer runs --headless. The diff buffer that
   vim.pack.update opens *is* the per-plugin changelog, and that was
   being thrown away under headless. Drop --headless from the justfile
   recipe and the trailing :qa! from config.update.run() so the buffer
   stays open until the user reviews and quits manually. Mason output
   was already visible because mason-tool-installer print()s.

2. New waybar 'custom/update' module + matching mako notification as a
   gentle staleness reminder, replacing any temptation to run
   unattended pacman -Syu (a bad idea on Arch: rolling, news-driven
   manual interventions, AUR rebuilds, partial-upgrade hazards).

   Source of truth: /var/log/pacman.log — last '[PACMAN] starting full
   system upgrade'. No daemon, no -Sy poll, no extra state file beyond
   a per-session notify-throttle stamp in $XDG_RUNTIME_DIR.

   Tiers (hours since last full upgrade):
     <  24h   hidden   (":empty" via #custom-update.fresh padding 0)
     24-168h  yellow   + normal-urgency mako, throttled to 1/24h
     >= 168h  red      + critical-urgency mako, throttled to 1/24h

   Click runs 'just update' in a floating ghostty.

1 files changed, 2 insertions, 2 deletions

diff --git a/justfile b/justfile
index 01894f2..653711c 100644
--- a/justfile
+++ b/justfile
@@ -52,9 +52,9 @@ flatpak-update:
             rm -f "$tmp"
         done
 
-# Update Neovim plugins (vim.pack) and Mason tools in a headless session
+# Update Neovim plugins (vim.pack) and Mason tools, interactively so the diff buffer is visible
 nvim-update:
-    nvim --headless '+lua require("config.update").run()'
+    nvim '+lua require("config.update").run()'
 
 # Re-add changes from live files back into the repo; pass a path to target one, or omit for all
 re-add *paths: