v1.8.0 — Static targets named bare get supervised

Six days, 48 commits and six entries since v1.7.0. The trace contract stays v18; next_step gains one value, observe_supervised. No contract_version, unknown_reason or setup_error_reason changes. The full section is CHANGELOG.md at this tag.

A statically linked target refused no_shim_marker is told to run again with --observe supervised, whether the operation names its image by path or by a bare name (#672, ADR 0090). In v1.7.0 the default mode named supervised only in the refusal's detail, and only when the first word was a path; a bare kubectl … or terraform fmt, written the way a user writes it, got a --shim next step that named no mode. A bare first word is now looked up along the engine's PATH, with a relative component taken against the define's cwd, and the image found is read the way a named path is. On a 32-bit static image the refusal keeps its class-wall step: supervised does not see i386-compat or x32 calls.

Dogfood through the released v1.7.0, four campaigns: six fresh tools to verified FAILs (2026-09-28); the twelve tools that had cleared the entry gate (twelve FAILs); the 28 targets no campaign had carried to a verdict (9 FAIL, 3 PASS); and twenty tools whose state git does not hold, in four rounds of five (12 FAIL, 7 PASS). Reported upstream from them: nbQA-dev/nbQA#908, hashicorp/terraform#39299, helm/helm#32709, tombi-toml/tombi#2265, ktlint/ktlint#3409, orhun/git-cliff#1650, Yakitrak/notesmd-cli#137, mbloch/mapshaper#706 and mhx/dwarfs#388. The last campaign also found a limit of this release, filed as #678: restore does not reproduce permission bits, so a target that checks a mode in its state root cannot be measured, and preflight's next step points at the define.

Changed. The CI quickstart pins v1.7.0; it moves to this release once these assets exist.

Assets: sideeye-v1.8.0-aarch64-macos.tar.gz, sideeye-v1.8.0-x86_64-linux.tar.gz, sideeye-v1.8.0-aarch64-linux.tar.gz, each carrying the sha256 GitHub computed on upload (docs/cli.md says how to check one). Homebrew: brew upgrade yottayoshida/tap/sideeye once the tap is updated.