release(v1.7.18-alpha): transitive peers default Trusted + update-flow logs

Flip transitively-discovered federation peers to Trusted instead of
Observer. Hints are already only ingested from peers we trust and only
peers we trust are re-exported via build_local_state, so the chain of
trust is already vetted end-to-end — making the user promote each
newcomer by hand was friction with no security win.

Backend:
- federation/sync.rs: merge_transitive_peers now inserts TrustLevel::Trusted
  (doc comment updated to explain the transitive-trust rationale)
- update.rs: info! log at download start (version, components, total_bytes,
  staging path), cancel (staging wiped?, marker cleared?), and apply (backup
  path) so journalctl reveals where a stuck update actually is

Frontend:
- SystemUpdate What's New block gets a v1.7.18-alpha entry

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

core/archipelago/src/federation/sync.rs

@@ -107,8 +107,10 @@ pub async fn sync_with_peer_by_did(
 }
 
 /// Merge peers advertised by a Trusted federated node into our own
-/// federation list. New peers are added at `Observer` trust (not
-/// Trusted — that requires a direct invite). Existing peers get their
+/// federation list. New peers are added at `Trusted` — hints only
+/// arrive from peers we already trust, and `build_local_state` only
+/// re-exports our Trusted list, so transitive membership carries the
+/// same trust the direct-invite path gives. Existing peers get their
 /// `fips_npub` refreshed if we hadn't learned it yet.
 ///
 /// Peers we are (us) or that we already track by DID are skipped.
@@ -142,7 +144,7 @@ async fn merge_transitive_peers(
             pubkey: hint.pubkey.clone(),
             onion: hint.onion.clone(),
             name: hint.name.clone(),
-            trust_level: TrustLevel::Observer,
+            trust_level: TrustLevel::Trusted,
             added_at: chrono::Utc::now().to_rfc3339(),
             last_seen: None,
             last_state: None,