jevnav v0.1.8

jevnav 0.1.8 — replay stays honest across versions, and the plugin stops leaking.

moved compared absolute positions in the shortlist, so any change to the
extractor's ordering turned every step of an old trace into moved forever —
the two committed example traces (written by 0.1.0) had shipped that way since
0.1.1. moved now requires the candidate set to have drifted; an identical set
with a different position is ok, with the re-rank stated in the reason. Both
examples replay all-ok without being regenerated.

The pytest plugin:

• resolves ${VAR} before extraction and the decision, so a missing variable
  fails the test instead of costing a Jev call first;
• masks the os.environ["TOKEN"] reflex: a value that already is an environment
  value is recorded by name (value_from_env) with a warning, instead of the
  literal landing in a committed trace.

SPEC.md's candidate table now documents value and rank.

208 tests (207 pass, 1 skip).