Fix second audit findings and restore crash detection dialog

Address 29 issues found in comprehensive API/spec audit:
- Fix .desktop Exec key path escaping per Desktop Entry spec
- Fix update dialog double-dispatch with connect_response
- Fix version comparison total ordering with lexicographic fallback
- Use RETURNING id for reliable upsert in database
- Replace tilde-based path fallbacks with proper XDG helpers
- Fix backup create/restore path asymmetry for non-home paths
- HTML-escape severity class in security reports
- Use AppStream <custom> element instead of <metadata>
- Fix has_appimage_update_tool to check .is_ok() not .success()
- Use ListBoxRow instead of ActionRow::set_child in ExpanderRow
- Add ELF magic validation to architecture detection
- Add timeout to extract_update_info_runtime
- Skip symlinks in dir_size calculation
- Use Condvar instead of busy-wait in analysis thread pool
- Restore crash detection to single blocking call architecture

src/core/updater.rs

@@ -762,8 +762,12 @@ pub fn version_is_newer(latest: &str, current: &str) -> bool {
         }
     }
 
-    // If all compared parts are equal, longer version wins (1.2.3 > 1.2)
-    latest_parts.len() > current_parts.len()
+    // If all compared parts are equal, only consider newer if extra parts are non-zero
+    // (e.g., 1.2.1 > 1.2, but 1.2.0 == 1.2)
+    if latest_parts.len() > current_parts.len() {
+        return latest_parts[current_parts.len()..].iter().any(|&p| p > 0);
+    }
+    false
 }
 
 /// Parse a version string into numeric parts.
@@ -781,13 +785,13 @@ fn parse_version_parts(version: &str) -> Vec<u64> {
 
 /// Check if AppImageUpdate tool is available on the system.
 pub fn has_appimage_update_tool() -> bool {
+    // Check that the binary exists and can be spawned (--help may return non-zero)
     std::process::Command::new("AppImageUpdate")
         .arg("--help")
         .stdout(std::process::Stdio::null())
         .stderr(std::process::Stdio::null())
         .status()
-        .map(|s| s.success())
-        .unwrap_or(false)
+        .is_ok()
 }
 
 /// Batch check: read update info from an AppImage and check for updates.
@@ -935,7 +939,8 @@ pub fn download_and_apply_update(
 
     // Atomic rename temp -> target
     if let Err(e) = fs::rename(&temp_path, appimage_path) {
-        // Try to restore backup on failure
+        // Clean up temp file and restore backup on failure
+        fs::remove_file(&temp_path).ok();
         if let Some(ref backup) = backup_path {
             fs::rename(backup, appimage_path).ok();
         }