Every notification hub posts shows its text exactly as written #378

Current state

New notification text built the way the credential notification is built would fail to post, or show altered text, whenever it starts with [, (, {, " or '. post_command in daemon/src/notification.rs passes the title and message to terminal-notifier unescaped, while post_turn_command escapes them through shown_as_written. remove_command does the same work as remove_group_command(GROUP). Every credential message today is fixed text that starts with a letter, so nothing fails yet.

Ideal state

• A credential notification shows its title and message unchanged, whatever character they start with, the same way a pull request card does
• daemon/src/notification.rs has one way to post a notification and one way to remove a group, so new notification text cannot skip the escaping

Decisions

Constraints

No recorded decisions bind this work (checked the titles in docs/decisions/).

Open

No open decisions.

Starting points

• daemon/src/notification.rs — the four command builders and shown_as_written
• domain/src/credential_notification.rs — the credential notification text