v2.8.1
Fixes the S3358 nested-ternary regression in the new `worktrees unlock` command (worktrees_cmd.py), which is a gated file and kept the release commit red, and re-cuts the release as 2.8.1. Content is otherwise the intended 2.8.0 (Codex OAuth fix, worktree GC reliability, the unlock command, and the security cleanup); 2.8.0 was never tagged.