Fix second audit findings and restore crash detection dialog

Address 29 issues found in comprehensive API/spec audit:
- Fix .desktop Exec key path escaping per Desktop Entry spec
- Fix update dialog double-dispatch with connect_response
- Fix version comparison total ordering with lexicographic fallback
- Use RETURNING id for reliable upsert in database
- Replace tilde-based path fallbacks with proper XDG helpers
- Fix backup create/restore path asymmetry for non-home paths
- HTML-escape severity class in security reports
- Use AppStream <custom> element instead of <metadata>
- Fix has_appimage_update_tool to check .is_ok() not .success()
- Use ListBoxRow instead of ActionRow::set_child in ExpanderRow
- Add ELF magic validation to architecture detection
- Add timeout to extract_update_info_runtime
- Skip symlinks in dir_size calculation
- Use Condvar instead of busy-wait in analysis thread pool
- Restore crash detection to single blocking call architecture

src/core/duplicates.rs

@@ -329,6 +329,8 @@ fn build_name_group(name: &str, records: &[&AppImageRecord]) -> DuplicateGroup {
 }
 
 /// Compare two version strings for ordering.
+/// Falls back to lexicographic comparison of cleaned versions to guarantee
+/// the total ordering contract (antisymmetry) required by sort_by.
 fn compare_versions(a: &str, b: &str) -> std::cmp::Ordering {
     use super::updater::{clean_version, version_is_newer};
 
@@ -339,8 +341,11 @@ fn compare_versions(a: &str, b: &str) -> std::cmp::Ordering {
         std::cmp::Ordering::Equal
     } else if version_is_newer(a, b) {
         std::cmp::Ordering::Greater
-    } else {
+    } else if version_is_newer(b, a) {
         std::cmp::Ordering::Less
+    } else {
+        // Neither is newer (unparseable components) - use lexicographic fallback
+        ca.cmp(&cb)
     }
 }