release: prepare v0.8.0

[codethor0]

Goal

Prepare v0.8.0, following the convention of #35: version bump in package.json, package-lock.json, and SERVICE_VERSION, plus a dated changelog entry.

Scope / non-goals

Changed: version 0.7.0 to 0.8.0, the Unreleased changelog regrouped into a dated 0.8.0 entry that leads with client-visible changes, and the README agent example's service_version.

Not changed: any runtime behavior. This PR does not deploy anything. Candidate upload, zero-percent smoke, promotion, and the GitHub release remain the human-gated flow in docs/RELEASE.md. The README's "Supported release" line stays on v0.6.2 until production actually moves, as in #33.

Public contract

Minor bump because of two client-visible changes already merged in #36:

• Query strings on /, /v1/health, /v1/categories, /v1/stats, and /openapi.json now return 400 INVALID_REQUEST.
• Validation error message text is longer (it names the allowed values). The code field is unchanged.

Both are called out at the top of the changelog entry.

Security impact

• No new secret or credential handling
• No new outbound network access
• No new persistence or user data
• No new runtime dependency
• Threat model updated if attack surface changed -- unchanged

Verification

• Tests added or updated when behavior changed -- no behavior change
• npm run verify (94 tests)
• git diff --check
• Public docs and OpenAPI updated if behavior changed -- OpenAPI info.version follows SERVICE_VERSION
• Change is intentionally scoped and contains no unrelated cleanup

🤖 Generated with Claude Code