safeHttpsUrl accepted any https:// string unbounded, so a CLI-returned
action URL reached Qt.openUrlExternally without a length bound. Cap at
2048 characters like the other descriptor text bounds; longer addresses
report an unsupported URL. Selected from the bug hunt by a Jev
ship-decision (noul 0.78, jev-1.13.0); threshold and notification
suspects were cleared at their call sites.