[Feature]: [P3] Render curated changelog notes as markdown in the update modal

Deferred by the versioning/changelog party (2026-07-16). Do not ship without the guardrails below.

The build reads CHANGELOG.md and feeds the update modal plain text (markdown is flattened by notesForVersion in src/changelog.ts, which parses with CommonMark via marked at build time). Rendering an inline markdown subset inside the modal was considered and deferred: the update prompt is the reload-critical surface, so any markdown-to-HTML there opens an XSS lane for questionable benefit on 1 to 3 short lines.

If revisited, the constraints are:

• Allow only an inline emphasis subset (bold/em), nothing block-level.
• Emit lit templates, never raw HTML (no unsafeHTML).
• No links, images, or attributes (no href means no javascript: lane).
• Vet the added dependency size; the current parser is build-time only, so a modal renderer would be the first markdown code to ship to the browser.

Today the file can stay rich markdown for human reading while the prompt stays plain and safe, so this is a nice-to-have, not a fix.

Start with src/changelog.ts and notesForVersion, then trace how the plain-text output reaches the update modal. If revisited, define the allowed inline emphasis behavior and verify the result uses lit templates without unsafeHTML, with no links, images, or attributes; also assess the browser bundle impact of any parser dependency.