Release v3.8.0

Changed

• The client now uses grpc 1.x: grpc ~> 1.0, Mint 1.11 or later, cratis_chronicle_contracts 19.19 or later (the first contracts release on grpc 1.x), and Elixir 1.18 or later. Applications that also call GRPC.Stub.connect/2 themselves should pass adapter: GRPC.Client.Adapters.Mint (or add Gun), and no longer need to supervise GRPC.Client.Supervisor.
• Each Chronicle connection owns and supervises its own gRPC transport, so stopping, restarting or killing a client closes its channels and sockets, and no orphaned connection is left under grpc's global supervisor.
• HTTP/2 server push is disabled on Chronicle channels. An application-level Mint client_settings that does not keep enable_push: false is rejected at startup.

Fixed

• Stopping a client during a stalled compatibility check or an in-flight OAuth token request completes within the shutdown budget.
• Failed OAuth token requests close their socket.

Security

• The four grpc 0.x advisories no longer apply to the client (CVE-2026-48599, CVE-2026-48853, CVE-2026-48854, CVE-2026-53430), nor the Mint 1.10 advisories.

API keys and bearer tokens can still appear in crash reports from grpc's own response process; that is tracked in #79. The final review rounds were done by a single model provider (Claude Opus); cross-provider review was unavailable.

Refs Cratis/Chronicle#4214