chore(release): prepare v0.8.0

[owainlewis]

Summary

• Bump the Cargo package and lockfile identity to 0.8.0.
• Gate release builds on an existing Git tag that exactly matches the Cargo package version.
• Add tested release-version tooling, weekly RustSec advisory checks, and grouped Dependabot updates for Cargo and GitHub Actions.
• Preserve the existing Ubuntu and macOS release artifact matrix and packaging behavior.

Why

Release archives must identify the same version as the binary, and locked Rust dependencies need ongoing advisory coverage before the project reaches more users.

Test plan

• cargo fmt --all --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo test --locked (343 tests passed across all test targets)
• cargo build --locked
• bash tests/install.sh
• bash tests/release-version.sh
• cargo audit 0.22.2 (211 locked dependencies, no vulnerabilities)
• actionlint 1.7.7 on all GitHub Actions workflows
• YAML parse validation for workflows and Dependabot configuration
• cargo metadata and built binary both report 0.8.0
• Release tag guard success and missing-tag failure paths verified in an isolated Git fixture
• Independent review approved with no actionable findings

Risks

The hosted RustSec installation path and Dependabot behavior require GitHub execution. No release was tagged or published.

Related issue

None.