Story: Update vendored ORE Engine to 1.8.16.0

Verifying "the RPATH points somewhere inside the package" is necessary but not sufficient – a package can be structurally self-contained and still be wrong (missing a library, a corrupted copy, a version skew between bundled libraries). The self-test extracts the package to an isolated scratch directory, runs it against TA002_IR_Swap exactly the way ores.compute.wrapper does (same invocation shape, same cwd semantics), and tolerantly diffs the real output against real ExpectedOutput/, writing a human-readable sign-off report. Rejected a byte-exact diff (cross-compiler/library floating-point noise and legitimate schema evolution – e.g. new report columns on a version bump – would both cause false failures).

The alternative (documenting the 3 hand-patched files in prose and trusting a future refresher to read and reapply them) is exactly the failure mode that had already silently regressed once before this story even started work (caught live during this same task). Automation is strictly better than documentation here since the fix is small, mechanical, and safe to reapply unconditionally (a no-op if upstream ever fixes it at the source).

Regenerating the entity from ores.compute.app_version_platform_junction.org would have renamed files, added several unrelated audit columns, and silently dropped the hand-added platform_code denormalisation still used by workunit_handler.hpp – pre-existing drift unrelated to the SHA256 column. Added the sha256 column by hand instead, matching the existing hand-maintained style; a full codegen realignment for this entity is separate follow-up work, not folded into this story.

save_app_version_request replaces every app_version_platform row for a version wholesale by design (it's the same request whether the caller is adding a platform or editing an existing one, and there's no per-row upsert semantics in the protocol). That means every caller publishing a single platform at a time – ores.shell's publish-package and ores.qt's UploadEnginesDialog – must fetch the version's currently-published platforms first, replace only the one being republished, and send the full merged set back. Getting this wrong is silent data loss (a working platform's package_uri/sha256 vanishes) rather than a visible error, so both call sites do the fetch-merge-save dance rather than trusting the request to be additive.