feat(sw): offer a reload when a newer version is ready

The shell is served cache-first, which is what makes the app work on a
train and also what makes a deploy invisible: a reader with the tab open
— the reader this app is built for — keeps running the bundle they first
loaded, so a new game or a corrected date reaches their device and sits
there with nothing saying why the page looks unchanged. An old app shown
as current is the same failure as old events shown as current.

So the worker now installs quietly and waits instead of calling
skipWaiting(), the page notices it waiting and says so, and the reader's
tap sends the skip-waiting message and reloads on controllerchange. The
app never reloads itself: someone may be mid-way through typing in one of
their own events, and the notice says what a reload costs (their place on
the page) and what it does not (marks and notes live in localStorage).

Detection is derived rather than remembered. build:static grew into a
script that stamps sw.js with a hash of the built shell, because the
browser only offers a worker whose bytes differ, and the predecessor —
a hand-bumped CACHE_VERSION — had already been forgotten once. The feed
is deliberately not part of that hash: it changes twice a day, needs no
reload, and announcing it would teach readers to dismiss the notice
unread. The cache name stays put for the same reason a per-build one
would be wrong — it holds the feed an offline reader is reading.

A first install is not an update and stays silent.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

README.md

@@ -190,6 +190,14 @@ offline is shown in the header and above the footer, because stale data must nev
 
 It installs to a home screen as a standalone app.
 
+## Updates
+
+Because the shell is cached, a tab left open keeps running the version it loaded — so when a newer
+one has been fetched and is ready, the app says so and offers to reload. You choose the moment: the
+only thing a reload costs is your place on the page. Everything you have marked, typed or ticked
+lives in your browser, not in the bundle, so it survives untouched. Dismiss it and the offer comes
+back next time you open the app.
+
 ## Conduct
 
 Sources are community wikis, treated as a guest would: `robots.txt` honoured, a descriptive