feat(waybar,nvim): update-staleness reminder; nvim update visible

Two related changes around the 'just update' UX:

1. nvim-update no longer runs --headless. The diff buffer that
   vim.pack.update opens *is* the per-plugin changelog, and that was
   being thrown away under headless. Drop --headless from the justfile
   recipe and the trailing :qa! from config.update.run() so the buffer
   stays open until the user reviews and quits manually. Mason output
   was already visible because mason-tool-installer print()s.

2. New waybar 'custom/update' module + matching mako notification as a
   gentle staleness reminder, replacing any temptation to run
   unattended pacman -Syu (a bad idea on Arch: rolling, news-driven
   manual interventions, AUR rebuilds, partial-upgrade hazards).

   Source of truth: /var/log/pacman.log — last '[PACMAN] starting full
   system upgrade'. No daemon, no -Sy poll, no extra state file beyond
   a per-session notify-throttle stamp in $XDG_RUNTIME_DIR.

   Tiers (hours since last full upgrade):
     <  24h   hidden   (":empty" via #custom-update.fresh padding 0)
     24-168h  yellow   + normal-urgency mako, throttled to 1/24h
     >= 168h  red      + critical-urgency mako, throttled to 1/24h

   Click runs 'just update' in a floating ghostty.

0 files changed, 0 insertions, 0 deletions