Fix push-digest sentinel filter, watermark, and cleanups from review

- push digest queries now exclude _duplicate channel like every other
  visibility query (bookmarks list/count and NewClassifiedSince)
- advance push watermark to newest scanned story, not pass-start now, so
  stories arriving during a long send pass aren't re-counted next pass
- replace hand-rolled escapeHTMLText with stdlib html.EscapeString
- drop em-dashes from user-facing copy; bump PWA CACHE_VERSION so clients
  pick up the changed shell assets

internal/web/static/js/reader.js

@@ -242,7 +242,7 @@
       : "";
     var href = safeURL(it.url);
     var note = '<p class="pete-reader-note">' +
-      (it.paywalled ? "This source is paywalled — the text above may be partial. " : "") +
+      (it.paywalled ? "This source is paywalled, so the text above may be partial. " : "") +
       (href ? 'Read it at the source: <a href="' + escapeHTML(href) + '" target="_blank" rel="noopener noreferrer">' +
               escapeHTML(it.source || "original article") + " ↗</a>." : "") +
       "</p>";