chore(release): cut v0.8.0 final (TP validated via rc.1)

[Luis85]

Summary

Back-bump 0.8.0-rc.1 → 0.8.0. v0.8.0-rc.1 validated the npmjs.com Trusted Publishing path end-to-end (run 25640962728): OIDC token minted, sigstore signed, npmjs.com accepted, sigstore provenance landed on the package page.

$ npm view specorator dist-tags --json
{ "latest": "0.7.0", "next": "0.8.0-rc.1" }

$ npm view specorator@0.8.0-rc.1 dist.attestations
{
  url: 'https://registry.npmjs.org/-/npm/v1/attestations/specorator@0.8.0-rc.1',
  provenance: { predicateType: 'https://slsa.dev/provenance/v1' }
}

After merging this PR, tagging v0.8.0, and dispatching release.yml with prerelease=false, the latest dist-tag moves to 0.8.0.

What changed since rc.1

File	Change
package.json	version 0.8.0-rc.1 → 0.8.0
README.md	badge + status banner: RC framing → v0.8.0 final framing; status banner now mentions TP restoration (ADR-0044) alongside plugin distribution (ADR-0043) as the two v0.8.0 headlines
docs/specorator.md	version line: RC framing → v0.8.0 final framing

CHANGELOG keeps both [v0.8.0-rc.1] (TP validation record) and [v0.8.0] (release content) entries.

Test plan

• `npm run check:public-surfaces` — README badge + status line and `docs/specorator.md` version line match `package.json#version` 0.8.0.
• Full sequential test pool — 445/445 pass.
• `npm run check:content` / `check:workflow` / `check:traceability` / `check:token-budget` / `check:claude-plugin` — all green.
• CI green on this PR.
• Post-merge: tag `v0.8.0` on main HEAD, dispatch `release.yml --ref v0.8.0 -f version=0.8.0 -f dry_run=false -f prerelease=false -f publish_package=true -f confirm=0.8.0`. Expected: OIDC publish succeeds, `latest` dist-tag moves to 0.8.0.
• Post-publish: `npm view specorator@0.8.0 dist.attestations` returns non-null provenance.
• Decommission `NPM_TOKEN` repo secret per ADR-0044 § Compliance.

🤖 Generated with Claude Code