bound notification delivery and expand placeholders once

Give the notification queue a buffer and drop events when it is full.
The channel was unbuffered, so a slow or hung notification command
blocked whichever UI or network callback happened to raise the event.

Expand the command placeholders in a single pass.
Substituting %event, then %who, then %what meant text arriving in an
earlier field could contain a later placeholder and have it expanded,
letting a remote user inject their own text into the command.

Move the command runner behind a build tag and drop the POSIX default
on Windows.
The helper script it pointed at does not exist there, so the default
was a command that could only fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui.go

@@ -39,7 +39,12 @@ func esc(str string) string {
 }
 
 func (b *Barnard) Notify(event string, who string, what string) {
-	b.notifyChannel <- []string{event, who, what}
+	// Notifications are best-effort: a slow external command must not block a
+	// UI or network callback. New events are dropped once the bounded queue is full.
+	select {
+	case b.notifyChannel <- []string{event, who, what}:
+	default:
+	}
 }
 
 func (b *Barnard) Beep() {