Release v2.8.0: lifecycle hardening and official mirror

[xxvcc]

Summary

• harden account identity, lifecycle locking, durable state, sshd/sudoers/scheduler cleanup, and self-upgrade
• make https://dl.ll.cd/linux-temp-admin the preferred signed release source with GitHub transport fallback
• add reproducible preparation, offline ed25519 signing, protected publication, and mirror synchronization workflows
• deploy and audit the restricted mirror receiver and Nginx policy

Verification

• full Go race and root integration race suites
• go vet, Staticcheck (ordinary and integration), govulncheck v1.6.0
• ShellCheck, actionlint, strict zizmor, receiver policy tests
• reproducible static amd64/arm64 builds and QEMU arm64 version probe
• Debian 12 real PTY --fix-sshd/reload/SSH/revoke recovery
• Rocky 9 clean dnf dependency install, sudo, and revoke
• public verified v2.7.3 to signed v2.8.0 candidate PTY upgrade

Release gate

Do not merge or tag until an independent reviewer, CODEOWNERS/rulesets, both protected Environments, and the OpenPGP tag-signing identity are configured and independently verified.