docs(theseus/0.3.28-notes): mention per-add-on update diagnostics

fc7629b landed in the 0.3.28 build but the release-notes text still
read as "three changes since 0.3.27". Adding it as (4) so the change
is visible on silentmode.st/releases/ once the site scp goes out.
Binaries unchanged (same 5d15508b / a5d346b9 hashes).

releases-manifest.json

@@ -41,7 +41,7 @@
       "platform": "win-x64",
       "signed": false,
       "signingAuthority": null,
-      "changes": "Three changes since 0.3.27. (1) Aegis (built-in wallet) gains its own update card in Settings > General, right beside Ariadne. Signed OTA updates ship without a Theseus release — Check for updates hits the same signed endpoint the boot timer uses; Restart to apply shows once a staged version is ready. (2) DevTools (F12 / Ctrl+Shift+I) opens docked to the right of the tab instead of popping a detached window, matching stock Chrome. (3) Search-engine favicons in Settings > Search now use Google's /s2/favicons service — the DuckDuckGo ip3 source returned 404 for enough hosts (Brave, Bing, Yandex, etc.) that half the list was falling through to the emoji placeholder. Everything from 0.3.22 – 0.3.27 rides along.",
+      "changes": "Four changes since 0.3.27. (1) Aegis (built-in wallet) gains its own update card in Settings > General, right beside Ariadne. Signed OTA updates ship without a Theseus release — Check for updates hits the same signed endpoint the boot timer uses; Restart to apply shows once a staged version is ready. (2) DevTools (F12 / Ctrl+Shift+I) opens docked to the right of the tab instead of popping a detached window, matching stock Chrome. (3) Search-engine favicons in Settings > Search now use Google's /s2/favicons service — the DuckDuckGo ip3 source returned 404 for enough hosts (Brave, Bing, Yandex, etc.) that half the list was falling through to the emoji placeholder. (4) Settings > Extensions > Check for updates now shows per-add-on status (up to date / fetch failed / signature invalid / staged etc.) instead of one indistinguishable 'up to date' line — a silent DNS or sig-verify failure will no longer look like success. Everything from 0.3.22 – 0.3.27 rides along.",
       "files": {
         "TheseusNavigator-Setup-0.3.28.exe": "5d15508bba929f1f074c052ac933863eadf6eb8e56984ebd5a1af75e80626643",
         "TheseusNavigator-0.3.28-portable.exe": "a5d346b97f5a13d85fa3bd301a72075ddb82fe636d7b1a51840ffd5a16d879f4"

releases/index.html

@@ -50,7 +50,7 @@
 
   <div class="rel">
     <h2>Theseus Navigator <span style="color:var(--acid)">0.3.28</span></h2>
-    <div class="meta">Windows 64-bit · unsigned · 2026-09-08 · <b>Aegis update card + DevTools in tab sidebar + real search-engine favicons</b> — Aegis (built-in wallet) gains its own update card in Settings > General next to Ariadne; signed OTA updates ship without a Theseus release. DevTools opens docked to the right of the tab instead of a detached window. Search-engine favicons switched from DuckDuckGo's flaky ip3 service to Google's /s2/favicons — no more emoji fallbacks for half the list. Everything from 0.3.22 – 0.3.27 rides along.</div>
+    <div class="meta">Windows 64-bit · unsigned · 2026-09-08 · <b>Aegis update card + DevTools in tab sidebar + real search-engine favicons + per-add-on update diagnostics</b> — Aegis (built-in wallet) gains its own update card in Settings > General next to Ariadne; signed OTA updates ship without a Theseus release. DevTools opens docked to the right of the tab instead of a detached window. Search-engine favicons switched from DuckDuckGo's flaky ip3 service to Google's /s2/favicons — no more emoji fallbacks for half the list. Settings > Extensions > Check for updates now surfaces per-add-on status (up to date / fetch failed / signature invalid / staged), so a silent DNS or sig-verify failure won't be mistaken for success. Everything from 0.3.22 – 0.3.27 rides along.</div>
 
     <div class="file">
       <div class="n"><a href="https://dl.silentmode.st/TheseusNavigator-Setup-0.3.28.exe">TheseusNavigator-Setup-0.3.28.exe</a> — installer</div>