REL-1.8.0-PREP-01: Prepare Thoth v1.8.0 release

[ja573]

Task identity

• Task ID: REL-1.8.0-PREP-01
• Owning issue: REL-1.8.0-PREP-01: Prepare Thoth v1.8.0 release #864 (parent coordination IMPORT-ORCID-PERF-01: Restore bounded contributor resolution for bulk import #850; released feature API-IMPORT-ORCID-BATCH-01: Add exact batch contributor lookup by ORCID #851 / PR API-IMPORT-ORCID-BATCH-01: Add exact batch contributor lookup by ORCID #860; CI prerequisite CTRL-CI-CLIPPY-MASTER-01: Propagate Clippy 1.98 baseline repair to master #861 / PR CTRL-CI-CLIPPY-MASTER-01: Propagate Clippy 1.98 baseline repair to master #862)
• Risk: MEDIUM
• Exact authorized base: master @ ce478426328559549327e87db9b58f76f624b94c
• Branch: release/v1.8.0 -> master
• Final head: 56c3be8c1916635804721b66a3825a5d28c789a6
• Release version: v1.8.0 (minor: the release line adds the additive public GraphQL field contributorsByOrcids)

Draft until independent exact-head review and separate merge authorization.

Changes

Two bounded commits:

1. 34b55d034677bf95a6146badd202542b26430043 - Update changelog for v1.8.0
2. 56c3be8c1916635804721b66a3825a5d28c789a6 - Bump v1.8.0

Changelog cut

Pure two-line insertion in CHANGELOG.md: ## [Unreleased] is left empty and a new
## [[1.8.0]](https://github.com/thoth-pub/thoth/releases/tag/v1.8.0) - 2026-08-29 heading is added
above the existing ### Added / ### Fixed sections. The two approved entries
(API-IMPORT-ORCID-BATCH-01, CTRL-CI-CLIPPY-MASTER-01) and all historical sections are byte-for-byte unchanged.

Version bump

All six Thoth workspace packages 1.7.0 -> 1.8.0 (thoth, thoth-api, thoth-api-server,
thoth-client, thoth-errors, thoth-export-server), and every exact internal workspace pin
=1.7.0 -> =1.8.0. Cargo.lock changes only the six corresponding [[package]] version lines.
No third-party dependency version moved; no dependency resolution changed.

Write scope

Exactly the eight authorized existing paths, no new files:

CHANGELOG.md
Cargo.lock
Cargo.toml
thoth-api-server/Cargo.toml
thoth-api/Cargo.toml
thoth-client/Cargo.toml
thoth-errors/Cargo.toml
thoth-export-server/Cargo.toml

Validation

• git diff --name-only <base>...HEAD - exactly the eight paths above.
• git diff --check <base>...HEAD - clean.
• cargo metadata --no-deps --format-version 1 - all six workspace packages report 1.8.0; no 1.7.0 remains in any manifest or in Cargo.lock.
• cargo fmt --all -- --check - clean.
• cargo check --locked -p thoth-api -p thoth-api-server -p thoth-client -p thoth-errors - clean (lockfile accepted under --locked).
• cargo clippy --locked -p thoth-api -p thoth-api-server -p thoth-client -p thoth-errors --all-targets --all-features -- -D warnings - clean.
• cargo test --locked -p thoth-api -p thoth-api-server -p thoth-client -p thoth-errors - 1228 passed, 0 failed (8 doc-tests ignored).

Environment limitation (not a source problem): thoth-export-server and the root thoth package cannot
be built in this local git worktree. thoth-export-server/build.rs (unchanged by this PR) calls dotenv(),
which resolves the main checkout's .env further up the tree, then unconditionally reads the
worktree-relative ../.env, which does not exist, and panics. The failure is version-independent and
reproduces regardless of this change; creating a local .env was deliberately not done, as it is
untracked scaffolding outside the authorized write budget. Full-workspace cargo check/test/clippy
coverage for those two packages is therefore delegated to PR CI.

Impact

No migration, GraphQL/API behaviour, runtime, authorization, workflow, toolchain, infrastructure or
deployment effect. Release identity/version metadata only.

Automatic PR CI and the normal automatic GHCR staging-pr-* publication are expected side effects of
opening this PR.

Explicitly not performed / not authorized

Merge; ready-for-review transition; tag creation; GitHub Release creation or publication; production
image publication; deployment or production activation; manual CI dispatch/rerun/cancel; force-push;
branch deletion; master -> develop reconciliation; any Metrics source mutation.

The Metrics v1.8.0 -> v1.9.0 migration-suffix reconciliation is tracked separately under #766 and is
untouched here.

Refs #864
Refs #850
Refs #851
Refs #861
Refs #766

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.