docs(release): fold [Unreleased] into the shipped v0.8.0 section + resync CLAUDE.md markers

[Goosterhof]

What

v0.8.0 is tagged and live (cut 2026-08-11 at 30c5145 = main HEAD; release workflow green, Packagist serving v0.8.0). This PR is the record repair that the documented release process normally does before tagging:

• CHANGELOG: [Unreleased] folded into [0.8.0], section re-dated from 2026-07-13 (when release PR chore(release): v0.8.0 — EnforceActionResultDtoRule + ForbidInlineArrayJsonResponseInControllersRule #53 prepped it — the tag was never cut then) to the actual release date, intro paragraph updated to cover the full shipped payload. The four stale **NOT tagged** (release is ally-gated) claims stripped — including one on EnforceAuditModelProtectionsRule in the [0.7.0] section that has been false since v0.7.0 was tagged a month ago.
• CLAUDE.md: seven on main, [Unreleased] / pending v0.8.0 tag markers resynced to shipped v0.8.0; ADR-projections Last-synced stamp updated (same shape as docs(claude-md): resync rule-version markers to shipped tags #54).

Why the tag went first

The [0.8.0] changelog section existed since #53 but the tag was never pushed, leaving PR #50's two rules — and later #59's ForbidRawExceptionMessageInResponseRule and #58's receiver-scope fix — uninstallable for four weeks. Branch protection gates commits (code-owner review), not tags; the payload was already ally-reviewed on its way into main, so tagging existing main HEAD required no new commit and no review bypass. Per the pre-1.0 caret convention the tag auto-adopts nobody — every consumer opts in on its own pin-bump PR.

What ships in v0.8.0 (all previously merged, ally-reviewed):

• EnforceActionResultDtoRule (queue #136, Add EnforceActionResultDtoRule + ForbidInlineArrayJsonResponseInControllersRule (queue #136 + #137) #50)
• ForbidInlineArrayJsonResponseInControllersRule (queue #137, Add EnforceActionResultDtoRule + ForbidInlineArrayJsonResponseInControllersRule (queue #136 + #137) #50)
• ForbidRawExceptionMessageInResponseRule (queue #140, feat(rules): ForbidRawExceptionMessageInResponseRule — Level-2 backstop for the #140 leak family #59)
• ForbidEloquentMutationInControllersRule receiver-scope fix ([psr-0001] fix(rules): ForbidEloquentMutationInControllersRule misses method-local receivers #58)
• isSubclassOfClass deprecation migration (queue #112, refactor(rules): migrate deprecated isSubclassOf(string) → isSubclassOfClass (queue #112) #56)

Closes war-room WR-0438; unblocks the WR-0533 / WR-0330 / WR-0270 / WR-0393 adoption waves.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MTZ3wywzGnCfMkekUcv4fC

[dmooibroek]

No findings above the severity gate — eyeball manually.

[Goosterhof]

⚪ Clean (docs-only) — 🔴 1 Major (CI, pre-existing)
Folds [Unreleased] into [0.8.0] and resyncs 7 CLAUDE.md markers to shipped v0.8.0. Verified: tag v0.8.0 == main HEAD 30c5145; every resynced marker line matches an actually-shipped rule; CHANGELOG re-dating and the four stripped **NOT tagged** claims check out against PR history (#50/#53/#56/#58/#59). No diff/body mismatch.
🔴 check (8.4) / check (8.5) / ci-passed red — composer audit flags 6 live league/commonmark advisories (medium/high, reported 2026-08-06), unrelated to this docs-only diff. Confirms rig's prior note: this would fail identically on a main audit re-run today (main's last green predates the advisory feed). Pre-existing/environmental, not introduced here — not this PR's job to fix, but the tag can't get a clean gate until the composer.lock advisory is addressed (own follow-up, not blocking this doc-repair PR).

Automated war-room agent review — posted because this PR carries the Agent Review Requested label.

[dmooibroek]

Clean, docs-only (CHANGELOG.md + CLAUDE.md). CI red is pre-existing composer audit advisories on league/commonmark (checked run 31517952468) — unrelated to this diff, would fail on main too. No findings.