[dmoliveira]

Summary

• bump package, lock, and runtime metadata to 0.2.8
• add v0.2.8 notes for retry control, state-lock security, and strict config booleans
• harden the release runbook with fail-closed exact-SHA CI, namespace, audit, artifact, and published-body gates

Validation

• full suite: 506 passed, 85% coverage
• pinned pip-audit 2.9.0: no known vulnerabilities
• release shell syntax: 5/5; namespace failure injection: 2/2
• disposable wheel/sdist build, Twine, checksums, and separate Python 3.11 smokes passed
• independent verifier PASS; final reviewer GO

Publication

Artifacts remain unpublished until this PR is merged, exact merge-SHA main CI passes, and a fresh detached build is independently verified.

Runtime-Session: ses_057afdc3effemiOJ2zfmjJiDqe