[bug-ops]

Summary

• Bump version from 0.7.0 to 0.8.0 (minor, because the release contains breaking API changes before 1.0.0)
• Finalize CHANGELOG.md: the unreleased notes are condensed by area, and the dependency, CI and security entries missing since v0.7.0 are added
• Refresh the README files for the new version and the reader, sink and in-memory APIs
• Update user and contributor documentation: CONTRIBUTING.md (WASI build, fuzz targets, test fixtures) and SECURITY.md (in-memory extraction, atomic extraction in the CLI)
• Update the specifications for the 0.8.0 changes, with a new spec 020 for the reader, sink and in-memory API
• Update dependencies: napi 3.16, napi-derive 3.7, zip 9.2, @biomejs/biome 2.6.4, plus Cargo.lock and pnpm-lock.yaml

Checklist

• Version updated in all manifests
• Cargo.lock and pnpm-lock.yaml refreshed
• CHANGELOG.md has a release section with a date
• README, documentation and specs reflect the new version
• fmt, clippy, tests, doc tests, rustdoc, release build, cargo publish --dry-run, semver-checks, MSRV 1.98.0 and cargo deny pass locally
• All CI checks pass
• Ready for tagging after merge