release: harden data path and publish 0.8.1

[SamuelSupe]

What

• Fix benchmark accounting so publish success is not mistaken for end-to-end delivery.
• Harden delivery generations, buffered-write leases, disconnect handling, durable DLQ moves, payload/recovery I/O guards, management fencing and bounded control planes.
• Bump Rust, Console UI and Helm metadata to 0.8.1.
• Refresh the README with reliability fixes, download assets and deployment examples.
• Add version verification, release packaging and tag-driven GitHub Actions publication for Linux x86_64/ARM64, source, Helm and SHA-256 assets.

Why

The NSQ comparison exposed that the benchmark could report the publish count while fewer messages were actually received. Follow-up P0/P1 review found stale acknowledgement, cancellation, crash-recovery and unbounded-input paths that could also make delivery accounting or operational state diverge under failure.

Compatibility

• Disk format remains v7; no 0.8.0 data migration is required.
• NSQ V2, TLS/mTLS, AUTH, compression and opt-in Kodo behavior remain compatible.
• Delivery remains at least once; ambiguous disconnects may redeliver, while stale acknowledgements can no longer settle a newer delivery.
• A v0.8.1 tag publishes a GitHub Release only after the production gate and both native packages pass.

Validation

• FULL=1 K8S_ACCEPTANCE=0 FUZZ_SECONDS=1 ./scripts/release-gate.sh
  • 361 Rust tests
  • strict Clippy and formatting
  • four SIGKILL crash-recovery boundaries and the 100 MiB message boundary
  • Console UI check/build and Helm lint/template
  • seven nightly sanitizer fuzz targets
  • Go/Python plain and secure compatibility matrices
• ./scripts/verify-release-version.sh 0.8.1
• actionlint for .github/workflows/ci.yml
• ShellCheck for both release scripts
• local ARM64 binary bundle plus source and Helm package inspection
• git diff --check