chore(release): 0.8.0

Minor rather than patch: three user-visible behaviour changes — cloud/D2D backup
disabled, the Android TV launcher entry withdrawn, and lockscreen skip scrubbing
rather than advancing during background audio.

CHANGELOG.md

@@ -9,6 +9,76 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).
 
+## v0.8.0
+
+A security and correctness release, from an audit of the codebase against its own
+requirements and against current Android/Tauri practice. Most of it is invisible
+in use; three things change behaviour you can see, listed first.
+
+### ✨ Changes
+
+- **The app no longer backs its data up to your Google account.** It never
+  should have: `allowBackup` was on by default, which sent the library catalogue
+  and watch history off the device — and the credentials went with it in a form
+  that could never be read again, because they are encrypted under an Android
+  Keystore key and Keystore keys are never backed up. Restoring onto a new phone
+  therefore produced ciphertext with no key: an authentication failure with no
+  explanation. Backup is now off, for device-to-device transfer as well as cloud
+  (a separate channel with the identical failure), and an unreadable credential
+  blob is now treated as "logged out" rather than an error, so the next sign-in
+  repairs it. (UR-012 → DR-135)
+
+- **The app no longer offers itself as an Android TV app.** (This is about the
+  app icon on a TV device's home screen — your TV shows library is untouched.)
+  It advertised a leanback launcher entry without any of what makes a TV app work — no D-pad focus model,
+  no banner, and a missing touchscreen declaration that fails Play's TV
+  validation. Launching it on a TV would have landed you in a UI you could not
+  navigate. It can be re-declared when TV support is actually built.
+
+- **Lockscreen skip scrubs a film instead of leaving it.** While a video's audio
+  plays in the background, the skip buttons jump 30 seconds forward and 10
+  seconds back, rather than advancing to the next episode. There is no "next
+  track" inside a film, and pressing skip to re-hear a line should not eject you
+  from what you are watching. Music is unchanged: skip still moves through the
+  queue. (UR-040, UR-006 → DR-201)
+
+### 🔒 Security
+
+- **The webview now runs under a Content-Security-Policy.** It had none, so any
+  script reaching the web layer inherited the full IPC surface. `script-src` is
+  now `'self'` with no inline or eval, and plugins and frames are refused
+  outright. (UR-071 → DR-198)
+
+- **The webview stops undoing the network security config.** It set a blanket
+  cleartext opt-in by hand, along with file and content access it never used —
+  defeating the config that exists to block exactly that, and whose own comment
+  warned against it. (UR-071 → DR-199)
+
+- **The asset protocol no longer reaches the database or the credential store.**
+  Its scope was the whole app data directory; it is now the one subdirectory it
+  serves. (UR-012, UR-071 → DR-198)
+
+### 🐛 Fixes
+
+- **A credential store that could not be read is now recoverable.** The decrypt
+  failure surfaced as a hard error rather than a logged-out state, so the app got
+  stuck instead of offering the login screen. (UR-012 → DR-135)
+
+### 🔧 Internal
+
+- CI now enforces the checks the contributor rules already required —
+  `cargo fmt --check` and clippy — neither of which had ever run there. The
+  traceability gate was also raised from 50% to 82%, a floor low enough that half
+  the matrix could rot before it fired, and a new check fails the build on a
+  requirement ID that no longer exists.
+- Twelve requirements marked "Done" carried no implementation trace at all;
+  they are now tagged, and stale integration requirements that named a backend
+  never built have been re-scoped to the ones that actually deliver them.
+  Coverage moved 86% → 90%.
+- The Rust lint backlog is cleared (51 warnings → 0), and a flaky test that
+  intermittently reddened CI is fixed — it was paying a cold module-transform
+  cost inside a test body, not waiting on a timer.
+
 ## v0.7.0
 
 ### ✨ Changes