chore(release): prepare Otito v1.8.0

[nugehs]

Summary

• align package.json, package-lock.json, and the MCP Registry manifest at Otito 1.8.0
• add v1.8.0 release notes for the Herdr trust workspace integration merged in feat: add Otito trust integration for Herdr #127
• refresh the high-traffic README release callout for the Herdr actions and trust-status popup

Change Type

• Bug fix
• Feature
• Documentation
• Tests or CI
• Refactor

Validation

• npm run ci
• PullPass readiness passed or its WARN/FAIL state is explained.
• Focused tests or manual checks: tarball smoke reported v1.8.0; Homebrew and NVM CLI installations both reported v1.8.0; Herdr plugin reinstall registered all five actions and opened the native trust-status popup

Version Impact

• None: docs, tests, CI, or internal-only change
• Patch: bug fix or low-risk internal improvement
• Minor: new command, MCP tool, report field, or backward-compatible behavior
• Major: removed command, renamed field, incompatible output, or runtime requirement change

Review Notes

• I kept generated artifacts under .otito/ out of the commit.
• I updated README, skill docs, or eval metadata for command, package script, MCP tool, schema, or output changes.
• I identified any skipped checks or follow-up work below.
• I understand this PR needs maintainer/code-owner approval before merge.

Notes:

• Full local CI passed at v1.8.0: formatting, lint, typecheck, SemVer alignment, 403 tests, coverage thresholds, accuracy/harness/gate evaluations, dependency audit, doctor, harness, and tarball smoke.
• The exact staged-tree Otito gate returned WARN only because version and registry metadata require explicit maintainer review. Secret safety, release discipline, validation availability, dependency-audit availability, and local commit readiness passed.
• This PR prepares release metadata only. It does not create a tag, publish npm, create a GitHub Release, or publish the MCP Registry entry; those remain separate post-merge proof chains.