chore(distribution): publish v0.10.8 metadata

[killswitch-GUI]

What changed

• advance the repository-owned Homebrew formula source to v0.10.8 with the published Apple Silicon and Intel checksum sidecars
• advance flake.nix to v0.10.8 with the published hashes for all four supported Darwin/Linux targets
• leave flake.lock unchanged because the nixpkgs input did not change
• harden rootless Podman acceptance readiness by mirroring Colossus's cleared runtime environment and real mounted-write workload under a separate five-minute bound

Why

Release preparation intentionally leaves package definitions pinned to the latest already-published stable release. Now that v0.10.8 is public and anonymous distribution verification has passed, the final immutable asset hashes are available for the post-release metadata refresh.

The external obscuritylabs/homebrew-tap update was published separately in obscuritylabs/homebrew-tap#2.

The full-acceptance lane repeatedly exhausted the ordinary 90-second process budget on the first Colossus-mediated rootless Podman start even though its ambient warmup and the identical Docker suite passed. The revised warmup pays that one-time sanitized-runtime startup cost separately while leaving the live suite's 90-second success and 12-second enforcement budgets unchanged.

User impact

Nix installs from this repository resolve Colossus v0.10.8, and the repository-owned Homebrew source remains byte-for-byte aligned with the public tap formula.

Validation

• generated the Homebrew formula from the published v0.10.8 checksum sidecars and compared it byte-for-byte with packaging/homebrew/Formula/colossus.rb
• node --test scripts/ci/homebrew-formula.test.mjs
• repository pre-commit formatting and crate-root checks
• git diff --check
• cargo test --locked -p colossus-cli --test ci_contract premerge_requires_an_authorized_label_and_representative_platforms
• cargo clippy --locked -p colossus-cli --test ci_contract -- -D warnings
• local Nix validation unavailable because Nix is not installed; hosted package checks are expected to run

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is enabled.}