Release 2.8.0 step 2: merge v2/main into main and cut the release

[cliffhall]

Summary

Merge v2/main into main for the v2.8.0 milestone, smoke-test the release candidate from the production build, and cut the GitHub Release that triggers publishing.

Step 1 is #2453 / PR #2454: v2/main reads 2.8.0 and carries the release audit (0 vulnerabilities across all five installs).

Scope

• A milestone-merge branch cut from origin/main, taking v2/main whole — no commits of its own. The merge commit's tree must be byte-identical to origin/v2/main.
• npm run local:gate in a dedicated worktree with a full npm install, and npm run pack:verify as its own step (The release skill says pack:verify runs inside local:gate; it does not #2380).
• A hand-driven smoke of every contribution closed in the milestone, from the production build, through whichever clients each change touches.
• A ledger artifact recording what was driven and what was observed, linked from the PR for maintainer review.
• After merge: tag origin/main with the bare 2.8.0 (no v prefix) and publish the Release.

If the smoke finds something

The fix goes on v2/main, never on the merge branch — an ordinary PR against v2/main, then re-merge into the merge branch so it arrives the way everything else did.

Acceptance

• Merge commit tree hash == origin/v2/main tree hash
• npm run local:gate and npm run pack:verify pass on the merge branch
• Every closed milestone issue driven and recorded in the ledger
• Ledger artifact published and linked from the PR
• Release tagged 2.8.0 on origin/main and published

The merge is PR #2456; its ledger is https://claude.ai/artifact/YLGV4sYUwwRwusNNgPZPFF.