Prepare v0.8.0 session-budget review release

[kwisatzh]

Summary

Prepare v0.8.0 for maintainer review, with session-budget release notes, matching installer/docs versions, and packaged-binary session tests. README remains 169 lines. No production accounting or report behavior changes in this PR.

Vijay approved release preparation and confirmed the release date as 2026-10-11. The final head dates the changelog and removes the pending-approval sentence. Version links become live on publication; under his latest instructions Vijay performs the tag.

#49, the separate repair for the timed fuzz failure on main, is merged. This PR now targets main; all checks rerun on final head dcb9f11b87a6d88a80d8620e4007dff08cc75f10 before merge.

Release Notes

See docs/releases/v0.8.0.md: local LiteLLM session-budget review, exact observed distributions, cap review, shared session counters, evidence-based clipping, and additive agent_id / rejection_kind export columns. Older exports remain readable; two-period session comparisons remain key-scoped and byte-identical.

Checks

• Go 1.26.9: race tests and vet passed.
• All seven bounded fuzz commands passed three consecutive repeats, with fixed input counts.
• Source govulncheck and binary-mode checks of all four development packages found no vulnerabilities.
• Four development archives built; checksums verified. Native macOS ARM64 smoke and all packaged-binary tests passed, including the new session-budget tests.
• Linux ARM64 network-disabled/non-root smoke matched network-enabled output and exit codes for seven commands, including session-budget review.
• Pinned LiteLLM writer -> PostgreSQL -> read-only SQL -> packaged importer: 31 tests passed, with database tests enabled and no skips. Includes v0.7.0 compatibility and privacy checks.
• v0.7.0 two-period parity tests passed.
• Live collector demo and race-enabled two-operator integration passed.

These are pre-tag development packages, not published v0.8.0 artifacts. Exact-head hosted checks must pass; post-tag signature/provenance verification and a fresh released-binary outsider run are still required before publication/outreach, as recorded in RELEASING.md. No v0.8.0 tag or release was created.