BOM and `--pr` input handling in mcp_swap

Summary

Two small input-handling defects at the edges of scripts/mcp_swap.py. Filed together because both are one-line fixes in argument/decode handling; split if you would rather track them apart.

A UTF-8 BOM makes a config unswappable. Configs are read with a plain .decode(), so a byte-order mark — which editors on Windows still add — fails the parse for every CLI. It fails closed with a readable message, so this is an annoyance rather than a risk, but utf-8-sig would decode it.

[cursor] Unexpected UTF-8 BOM (decode using utf-8-sig): line 1 column 1 (char 0)

--pr accepts values that are not the number the user typed. The value goes through bare int(), which accepts underscore separators, a leading +, surrounding whitespace, and non-ASCII digits. --pr 1_0 silently swaps to PR 10:

$ run use-local --repo "$PWD" --cli cursor --pr '1_0' --no-preflight
PR #10

--pr '٥' (Arabic-Indic five) is accepted the same way.

Expected

A BOM decodes rather than failing the parse. --pr rejects anything that is not a plain run of ASCII digits, so a typo is an error instead of a different pull request.

References

• load_config decode at v0.1.0a20
• _pr_number at v0.1.0a20

Start in scripts/mcp_swap.py at load_config around lines 368-378 and _pr_number around lines 246-258. Verify that UTF-8 BOM input decodes successfully and that --pr accepts only plain ASCII digits, rejecting separators, signs, whitespace, and non-ASCII digits.