Fix push-digest sentinel filter, watermark, and cleanups from review

- push digest queries now exclude _duplicate channel like every other
  visibility query (bookmarks list/count and NewClassifiedSince)
- advance push watermark to newest scanned story, not pass-start now, so
  stories arriving during a long send pass aren't re-counted next pass
- replace hand-rolled escapeHTMLText with stdlib html.EscapeString
- drop em-dashes from user-facing copy; bump PWA CACHE_VERSION so clients
  pick up the changed shell assets

internal/web/static/js/pwa.js

@@ -101,7 +101,7 @@
         if (sub) return unsubscribe().then(function () { paint(false, "Notifications off."); });
         return Notification.requestPermission().then(function (perm) {
           if (perm !== "granted") { paint(false, "Permission denied."); return; }
-          return subscribe().then(function () { paint(true, "You're all set — new stories will nudge you."); });
+          return subscribe().then(function () { paint(true, "You're all set. New stories will nudge you."); });
         });
       }).catch(function () {
         paint(false, "Something went wrong. Try again.");