WA-NEW-009: Replace update_attributes/update_attributes! in production code

[jhill]

Goal: Remove deprecated update_attributes usage in core production code to unblock Rails 7 upgrade (use update / update!).

Scope: Focus on core/app/** and core/lib/** (not tests), keeping behavior identical.

Verify: bundle exec rake core_test TESTOPTS='--seed=2' (ensure no update_attributes deprecation warnings)
Branch pattern: wa-new-009-*
PR target: next

[kitcommerce]

Implemented on branch wa-new-009-replace-update-attributes (commit bf685c7): replaced deprecated update_attributes / update_attributes! calls in core production code with update / update!.

Note: I wasn’t able to get the requested full bundle exec rake core_test TESTOPTS='--seed=2' run green on next alone because the suite currently still trips over create_placed_order instability (WA-NEW-007) and ES query_string options (WA-NEW-011). Once those land together, the seed run should be meaningful.

[kitcommerce]

Heads up: this issue is still OPEN but has label status:done. If the work is truly complete/merged, we should close the issue (or swap the label back to status:ready/in-progress). Let me know if you'd like me to propose the exact cleanup (close vs relabel) once we confirm the related commit/PR.

[kitcommerce]

Label corrected to status:in-progress (PR already open: #633).