fix: tolerate UTF-8 BOM in manifest; sync docs to app/app.old model

#1 BOM: PowerShell Set-Content -Encoding UTF8 writes a BOM that made the in-app
json.loads silently fail (banner never showed even with an update available).
- update_service: decode manifest with utf-8-sig (HTTP + local)
- build.ps1: write manifest.json without BOM (UTF8Encoding $false)
- tests: +2 covering BOM manifests (HTTP + local)

#2 docs: docs/10 §16 status synced to the implemented app/app.old/version.txt +
SHA-256 model (stages 2/3 done + e2e verified); tasks 17.18 updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/services/update_service.py

@@ -86,13 +86,15 @@ def _load_http_manifest(update_source, update_user="", update_pass=""):
     with request.urlopen(req, timeout=5) as response:
         payload = response.read()
     if isinstance(payload, bytes):
-        payload = payload.decode("utf-8")
+        # utf-8-sig tolerates a UTF-8 BOM (PowerShell Set-Content -Encoding UTF8
+        # emits one); plain utf-8 would make json.loads reject it.
+        payload = payload.decode("utf-8-sig")
     return json.loads(payload)
 
 
 def _load_local_manifest(update_source):
     manifest_path = Path(update_source) / MANIFEST_NAME
-    with open(str(manifest_path), encoding="utf-8") as f:
+    with open(str(manifest_path), encoding="utf-8-sig") as f:
         return json.load(f)