Add Phase 5 enhancements: security, i18n, analysis, backup, notifications

- Database v8 migration: tags, pinned, avg_startup_ms columns
- Security scanning with CVE matching and batch scan
- Bundled library extraction and vulnerability reports
- Desktop notification system for security alerts
- Backup/restore system for AppImage configurations
- i18n framework with gettext support
- Runtime analysis and Wayland compatibility detection
- AppStream metadata and Flatpak-style build support
- File watcher module for live directory monitoring
- Preferences panel with GSettings integration
- CLI interface for headless operation
- Detail view: tabbed layout with ViewSwitcher in title bar,
  health score, sandbox controls, changelog links
- Library view: sort dropdown, context menu enhancements
- Dashboard: system status, disk usage, launch history
- Security report page with scan and export
- Packaging: meson build, PKGBUILD, metainfo

src/core/launcher.rs

@@ -4,6 +4,36 @@ use std::process::{Child, Command, Stdio};
 use super::database::Database;
 use super::fuse::{detect_system_fuse, determine_app_fuse_status, AppImageFuseStatus};
 
+/// Sandbox mode for running AppImages.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum SandboxMode {
+    None,
+    Firejail,
+}
+
+impl SandboxMode {
+    pub fn from_str(s: &str) -> Self {
+        match s {
+            "firejail" => Self::Firejail,
+            _ => Self::None,
+        }
+    }
+
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::None => "none",
+            Self::Firejail => "firejail",
+        }
+    }
+
+    pub fn display_label(&self) -> &'static str {
+        match self {
+            Self::None => "None",
+            Self::Firejail => "Firejail",
+        }
+    }
+}
+
 /// Launch method used for the AppImage.
 #[derive(Debug, Clone, PartialEq)]
 pub enum LaunchMethod {
@@ -137,6 +167,13 @@ fn execute_appimage(
     }
 }
 
+/// Parse a launch_args string from the database into a Vec of individual arguments.
+/// Splits on whitespace; returns an empty Vec if the input is None or empty.
+pub fn parse_launch_args(args: Option<&str>) -> Vec<String> {
+    args.map(|s| s.split_whitespace().map(String::from).collect())
+        .unwrap_or_default()
+}
+
 /// Check if firejail is available for sandboxed launches.
 pub fn has_firejail() -> bool {
     Command::new("firejail")