Integrate Brief2Ship 0.8.0 with discovery hardening

[five0nit]

Summary

• Integrate the supplied Brief2Ship 0.8.0 component update over v0.7.0.
• Add resumable source checkpoints, default static inspection, and consistent human/JSON discovery handoffs.
• Preserve uncertainty for unsupported alternative, negated, optional, and domain-language constraints; incomplete manifests cannot become verified zero dependencies.
• Harden malformed GitHub metadata handling and bounded PyPI identity/topic/hint retrieval.
• Include pinned version/commit, source observation timestamps, and structured requirement status/evidence in human output.

Assessment and verification

• Independent specification review: PASS; code quality: APPROVED after reproduced blockers were fixed with regression tests.
• Full release validation: 283 tests pass on Python 3.11, 3.12 and 3.13 locally; optional Trafilatura environment also passes.
• Synthetic benchmark: 29/29 cases pass. This is not an exhaustive live-retrieval accuracy claim.
• Critical lint, Pyright, documentation validation and whitespace checks pass.
• Fresh wheel/sdist build passes; extracted sdist repeats the full release gate; clean installed console smoke passes.
• Installed live GitHub/PyPI discovery and resume exercised; successful source observations preserved, candidates reranked/reinspected. Inconclusive selection is retained rather than misrepresented as a clean-build recommendation.
• Changed-file secret-pattern scan: no findings.
• Linux/Windows GitHub CI must pass before merge.

Scope and limitations

• No candidate code executed during discovery; no new runtime dependencies.
• Natural-language and dependency parsing remain a documented conservative static subset, not complete grammars.
• Update repository source only. No release tag, GitHub release, or PyPI publication.