v0.8.0

A run's form is now checked before its hours are spent. milestoner lint verifies every milestone
prompt against the conventions the evidence gate relies on - criteria that name their evidence, an
exit section with the run's tag, no scaffold residue - milestoner run refuses to start a run that
fails it, and the web panel reads, gates and overrides with exact parity to the terminal. The line
between mechanical form and human judgement is D-035: the linter checks form, the planner keeps
judgement. The feature was built by milestoner supervising itself, the third such run (v08-lint,
four milestones, all closed on the first attempt).

Added

• milestoner lint: checks the run's form - every milestone prompt, the protocol header and the
  config - before a session spends real time on it. Errors (missing prompt file, scaffold residue,
  missing objective or criteria, a criterion without an evidence note, an exit section without the
  run's tag) exit 1; warnings (orphaned prompt, protocol naming another run, empty liveness)
  alone exit 0. --json prints { run, errors, warnings, findings } for scripts. The rules are
  the pure lintRun core in src/lint.ts; the line between form and judgement is D-035.
• milestoner run lints at startup: error-level findings on milestones that are still pending
  refuse the start with the findings printed the way milestoner lint prints them, exit 1,
  before any session, state change or panel. --no-lint skips the gate; findings on done or
  blocked milestones never stop a resume, and warnings never block. Every start, gated, clean or
  bypassed, writes one lint summary line to run-log.md.
• The web panel keeps lint parity with the terminal: GET /api/lint returns exactly what
  milestoner lint --json prints, behind the same auth as every API route; the panel shows a lint
  card with the counts and the per-milestone findings before anything is started. Starting a run
  from the panel lints first, in the panel's process (the runner is spawned detached with its
  output discarded, so its own gate would refuse invisibly): error-level findings on pending
  milestones refuse with the counts and the first findings in the message, and a deliberate
  "start anyway" control passes --no-lint through to the spawned runner so the run log records
  the bypass.

Removed

• publish.yml, one release after it arrived. Its first exercise ended at npm auth (the trusted
  publisher was never configured) and 0.7.0 went out by hand; a publish is one command with
  prepublishOnly already gating it, so the automation was overhead, not safety.

Fixed

• bin drops its ./ prefix. npm 11 warns that the ./dist/cli.js form is invalid and rewrites
  the manifest while publishing; the plain relative path publishes clean, and npm 10 accepts both.