* feat(updates): open the release page from the update notification

Clicking the available-update notification now opens that release's page
on GitHub. The updater derives the page URL from the validated release tag,
UpdateLogic bounds it to https, and the applet opens it only after a
host-pinning guard accepts it and the dispatcher reports the notification's
default action activated. notify-send capability is probed so older libnotify
builds keep the plain, non-clickable notification.

* fix(updates): scope notification activation to its own command

Address review findings: activation now requires a zero notify-send exit
code, and pending release URLs are keyed by notification source so queued
actionable update notifications open their own release page instead of the
newest one overwriting the earlier association.