Take only acknowledgements from a desk click, and make each answer a one-time ticket

Review found that any process of the operator's account can choose a dunst action,
so a click could release or stop a delivery in the operator's name; that tokens
lived for ever; that a warning's answers died in ten seconds; and that a restarted
notifier left dead buttons (hq ADR 0258).

modules/dunst/cmd/dunst-tools/dunst.go

@@ -89,6 +89,11 @@ func Send(n Notification) (SendResult, error) {
 	if n.Icon != "" {
 		args = append(args, "--icon="+n.Icon)
 	}
+	if len(n.Actions) > 0 && n.ExpireMS < 0 {
+		// A notification that offers answers stays until it is dismissed: a warning's answers must not die
+		// with dunst's ten seconds (novox/hq ADR 0258).
+		n.ExpireMS = 0
+	}
 	if n.ExpireMS >= 0 {
 		args = append(args, "--expire-time="+strconv.Itoa(n.ExpireMS))
 	}