docs: record verified SDK 2.8.5 and middleware patches

[ty-everett]

Program and scope

Records verified publication of SDK 2.8.5, auth middleware 2.2.8 and payment middleware 2.1.8 from #600. The three published baselines and generated migration ledger now agree with npm. No runtime, package manifest, lockfile or infrastructure change is included.

• Tracker: fix(auth): preserve received payment headers and configure server payload capacity #600; active coordination #596. Standalone infrastructure reconciliation belongs to #601.
• Exact locally reviewed head: 112a0240fa8d1b41dd2f363a2a70df8892e2910c.

Impact

• No public package source or manifest changed
• Documentation or examples changed

Verification

• Node24.18.0/pnpm10.33.2: pnpm health:check, pnpm lint, pnpm format:check, pnpm build, pnpm typecheck pass.
• node scripts/package-documentation.mjs generated the migration ledger; no unrelated generated file changed.
• Source40dad06ddc96760470daf7fb20e856b44431c71e passed main CI, CodeQL, docs and Scorecard.
• Hosted CI36056428590, CodeQL36056428836, Sonar zero-new-findings gate and Socket checks passed on this head; CodeQL merge-ref has no open alerts. Runtime coverage, conformance, packed/browser consumers and mutation evidence remain in fix(auth): preserve received payment headers and configure server payload capacity #600; this PR changes no runtime bytes.
• I self-reviewed the complete diff for correctness, security, compatibility, artifacts, docs and operations.
• All applicable hosted checks are terminal and successful on this exact head.

Security and dependencies

• No dependency or lockfile change
• No new override, advisory dismissal, quality suppression, or skipped test
• New CodeQL/Sonar findings and review conversations must be clear before merge.

Release and operations

Protected release36052862859 succeeded. All three npm latest versions, downloaded SHA-256 and SHA-512 integrity values exactly match its immutable candidate. GitHub SLSA/CycloneDX attestations verify repository, release workflow, main ref and source commit; npm provenance identifies the same source and workflow run. The retained artifact is npm-release-36052862859-1.

• No npm publication was performed from a workstation or from this PR.
• Documentation and migration guidance reflect the verified publication.
• No new package release or deployment is caused by this bookkeeping.

Completion evidence

• Exact-head hosted gates complete; expected scope skips validated by merge-gate.
• Review conversations checked: no open conversations.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud