fix(service): migrate stale local protocol config

[bestlux]

Intent

Fix the MSI-owned service startup failure exposed by the 5.0.4 dogfood diagnostics. The service was reaching runtime preparation and then failing before SCM Running because the LocalSystem profile still had a Boundless config with protocol_version 4.1.0 while the current build expects 4.2.0.

This also adds rollback-surviving service lifetime diagnostics so the next package can distinguish manual stop/shutdown from serve errors or panics, and fixes package manifest version parsing when the packaged manifest has a UTF-8 BOM.

Changes

• Migrate persisted local config protocol_version 4.1.0 to the current protocol during config load.
• Keep unknown protocol mismatches fail-closed; this only permits the known local 4.1.0 -> 4.2.0 upgrade hop.
• Persist the migrated config back to disk so the service profile does not fail again on the next start.
• Add ProgramData diagnostics for SCM stop/shutdown controls, stop-pending/stopped, serve exit/error, panic hook, and runtime task health snapshots.
• Accept a leading UTF-8 BOM when reading package-manifest.json for service version/status clarity.
• Add regressions for stale local protocol migration, service-mode runtime prep with stale config, and BOM-prefixed package manifests.

Validation

• CARGO_INCREMENTAL=0 cargo test -p boundless-daemon load_or_create_config_migrates_previous_local_protocol_version -- --nocapture
• CARGO_INCREMENTAL=0 cargo test -p boundless-daemon service_mode_runtime_prep_migrates_stale_local_protocol_config -- --nocapture
• CARGO_INCREMENTAL=0 cargo test -p boundless-daemon service_mode_named_pipe_startup_preserves_diagnostic_input_state -- --nocapture
• CARGO_INCREMENTAL=0 cargo test -p app-services package_manifest_version_accepts_utf8_bom -- --nocapture
• CARGO_INCREMENTAL=0 cargo test -p boundless-cli package_manifest_version_accepts_utf8_bom -- --nocapture
• cargo fmt --all -- --check
• CARGO_INCREMENTAL=0 cargo clippy --workspace --all-targets -- -D warnings
• CARGO_INCREMENTAL=0 cargo test --workspace --quiet
• CARGO_INCREMENTAL=0 cargo build --release -p boundless-daemon --bin boundless-service
• git diff --check

Notes

The paired-but-disconnected dogfood report is real, but this PR intentionally does not diagnose or change peer connectivity/tray flow. Current stopped-service/no-pipe state after the user stopped service/tray is not treated as evidence of the connection failure.

Elevated validation

This worker shell is not elevated (CODY-PC\iomancer, Administrator=false), so I did not run an SCM/MSI install-start smoke and did not force UAC.