Fix second audit findings and restore crash detection dialog

Address 29 issues found in comprehensive API/spec audit:
- Fix .desktop Exec key path escaping per Desktop Entry spec
- Fix update dialog double-dispatch with connect_response
- Fix version comparison total ordering with lexicographic fallback
- Use RETURNING id for reliable upsert in database
- Replace tilde-based path fallbacks with proper XDG helpers
- Fix backup create/restore path asymmetry for non-home paths
- HTML-escape severity class in security reports
- Use AppStream <custom> element instead of <metadata>
- Fix has_appimage_update_tool to check .is_ok() not .success()
- Use ListBoxRow instead of ActionRow::set_child in ExpanderRow
- Add ELF magic validation to architecture detection
- Add timeout to extract_update_info_runtime
- Skip symlinks in dir_size calculation
- Use Condvar instead of busy-wait in analysis thread pool
- Restore crash detection to single blocking call architecture

src/core/database.rs

@@ -198,8 +198,7 @@ pub struct SandboxProfileRecord {
 }
 
 fn db_path() -> PathBuf {
-    let data_dir = dirs::data_dir()
-        .unwrap_or_else(|| PathBuf::from("~/.local/share"))
+    let data_dir = crate::config::data_dir_fallback()
         .join("driftwood");
     std::fs::create_dir_all(&data_dir).ok();
     data_dir.join("driftwood.db")
@@ -753,7 +752,7 @@ impl Database {
         is_executable: bool,
         file_modified: Option<&str>,
     ) -> SqlResult<i64> {
-        self.conn.execute(
+        let id: i64 = self.conn.query_row(
             "INSERT INTO appimages (path, filename, appimage_type, size_bytes, is_executable, file_modified)
              VALUES (?1, ?2, ?3, ?4, ?5, ?6)
              ON CONFLICT(path) DO UPDATE SET
@@ -762,17 +761,9 @@ impl Database {
                 size_bytes = excluded.size_bytes,
                 is_executable = excluded.is_executable,
                 file_modified = excluded.file_modified,
-                last_scanned = datetime('now')",
+                last_scanned = datetime('now')
+             RETURNING id",
             params![path, filename, appimage_type, size_bytes, is_executable, file_modified],
-        )?;
-        // last_insert_rowid() returns 0 for ON CONFLICT UPDATE, so query the actual id
-        let id = self.conn.last_insert_rowid();
-        if id != 0 {
-            return Ok(id);
-        }
-        let id: i64 = self.conn.query_row(
-            "SELECT id FROM appimages WHERE path = ?1",
-            params![path],
             |row| row.get(0),
         )?;
         Ok(id)