v0.8.0

Changed

• Default lock/trust filenames are now truecopy.lock / truecopy.trust
  (were canon.lock / canon.trust), finishing the canon→truecopy rename inside
  the tool: the CLI help, truecopy-mcp, and the Claude Code hook all say
  truecopy now. Fully back-compatible — with no --lock, an existing
  canon.lock (or canon.trust) is transparently read, so a repo pinned before
  the rename keeps verifying with zero changes; only a fresh pin writes the
  branded name. The canon / canon-mcp bin aliases, the ~/.canon global trust
  store, and the CANON_* env vars are all unchanged. (Unblocks fixing the CI
  action, whose docs already document truecopy.lock.)