fix: tolerate UTF-8 BOM in manifest; sync docs to app/app.old model

#1 BOM: PowerShell Set-Content -Encoding UTF8 writes a BOM that made the in-app
json.loads silently fail (banner never showed even with an update available).
- update_service: decode manifest with utf-8-sig (HTTP + local)
- build.ps1: write manifest.json without BOM (UTF8Encoding $false)
- tests: +2 covering BOM manifests (HTTP + local)

#2 docs: docs/10 §16 status synced to the implemented app/app.old/version.txt +
SHA-256 model (stages 2/3 done + e2e verified); tasks 17.18 updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tasks.md

@@ -912,8 +912,10 @@
 - [x] 启动器 `update.ps1` 改 HTTP：带凭据下载 zip → 校验 SHA-256 → 解压到 `staging\app.new` → `app/app.old` 切换回滚
 - [x] manifest 字段由 `source`/`files`/`marker` 改为 `url`/`sha256`/`size`
 - [x] 发布流程脚本：build → 打 zip → 算 SHA-256 → 写 manifest → 上传
+- [x] BOM 兼容：`check_for_update` 用 `utf-8-sig` 解码，`build.ps1` 写 manifest 不带 BOM（否则 PS5.1 的 UTF8 BOM 会让 app 内 `json.loads` 静默失效）；补 2 个 BOM 单测
+- [x] `update.ps1` HTTP 版以本地 HTTP server 假发布包端到端验证（拉清单→下载→SHA-256→`app/app.old` 切换）
 - [ ] 生产前将更新源切到 HTTPS、客户端改用只读账号
-- [ ] 真实环境端到端实测
+- [ ] 真实环境（cm.xiapi.com）端到端实测
 
 ## 18. 后续暂缓任务