fix(notify): cover expiry cleanup and harden the image-removal guard

Split the dismiss test so expiry is exercised on its own: Expire removes
the image without deleting the inert entry, and nothing asserted it.

removeImage now requires filepath.Dir(filepath.Clean(path)) to equal the
image directory, so a path carrying .. cannot reach a sibling daemon file
such as queue.json. The previous prefix test accepted it. Not exploitable
until Task 4 populates Popup.Image from a client hint, which is exactly
why the guard is fixed now.

0 files changed, 0 insertions, 0 deletions