Validate upstream CLI update release URLs with safeReleaseUrl and only provide the notification action button when a valid, bounded GitHub URL is present. Regression tests verify that untrusted and empty URLs stay non-actionable and are excluded from pendingUpdateReleaseUrls.