Orchestra 0.8.0

Follow-ups from the first real end-to-end runs, plus a resume path for runs held for approval. Everything new is opt-in or backward compatible.

• orchestra resume <runId> finishes a run that orchestra approve finalised with work still owed, on the same run id and integration branch. It runs the tasks that were blocked behind the approved task, then the deferred mutation pass and learning. Resume inherits the run's recorded worker isolation and refuses weaker settings unless --override-isolation is given. A lock stops two resumes of the same run (#81).
• Footprint scheduling: shared append-only files (throughput.sharedFiles, default ["CHANGELOG.md"]) no longer count as overlap, and they merge with git's union driver (#83).
• Budgets: each worker attempt logs the exact budget line its prompt carried (#84).
• Sandbox: opt-in sandbox.allowLocalBinding. Pre-flight checks argv pass-through for srt and docker (#77, #78).
• Fixed: runner accounting for sessions with more than one result message, the integrity monitor false positive on test fakes, and docker pre-flight tests that depended on writable /var/tmp (#78, #82).
• Bench: optional h2-none and h2-agentic arms, and the first H1/H2 findings in docs/status.md (#80).

The Claude Code sandbox backend has now run real workers. srt, docker and sandbox-exec still have not. Full details are in CHANGELOG.md.