v0.8.0

Release v0.8.0: protocol face hardened in place (frame type bytes renumbered into 0x20-0x2F control-plane pairs with Error 0xFF, the signed policy face is deny_unknown_fields, hub/ingress packs' listen is mandatory, and the QUIC control plane now fails closed with an Error frame instead of soft-failing older hubs — old packs re-render, peers rebuild together), config face made explicit (TLS validation rejects instead of warning, edge override fields, listen required), issuer store auto-backup (every identity change produces a versioned offline recipient-encrypted backup; the lost-store recovery path degrades from a full mesh rebuild to restoring one file), one-way blackhole detection (first-class liveness roundtrip, always-on off-tree probes, hub removal notification), egress drain made event-driven (two sleep(100ms) polls replaced by an inner-QUIC drain barrier), canonical pack rendering (all fields always written, rendered_by provenance stamp), CRL source pinned statically by identity_mode, GUI node-detail frequency layering and mesh observability faces, and nextest enforced as the single test runner