release: prepare v0.2.8 for Drive9 companion refresh

[qiffang]

Existing v0.2.7 installations cannot refresh only ti-drive9 with ti update: the updater returns early when the ti version is unchanged. Prepare v0.2.8 so those users have the normal update path to the newly published companion. The ti version is supplied by the release tag; no Go source version bump is required.

Add v0.2.8 release notes for Drive9 c6e057f and a README-linked release guide covering companion sources, pre-release verification, tagging, and publication checks. The notes describe the initial synchronization directory-read fix (Drive9 #1012) and layer/checkpoint drain and unmount fixes (Drive9 #1002). They include explicit ti version arguments, same-version reinstall instructions, and the Windows installer path.

This is a release-preparation documentation change. The companion remains a separate download from mutable endpoints: c6e057f is the verified upstream build, not a version pin. The ti archives contain only ti and README. Existing download behavior is unchanged; open ti PRs #63 and #69 are outside this release candidate.

Validation on macOS arm64, October 2, 2026:

• make test and make e2e passed.
• make release-snapshot GORELEASER=/tmp/ti-release-v0.2.8/goreleaser passed using checksum-verified GoReleaser v2.18.2. Verified archive contents and SHA-256 checksums for all five ti targets, and ran the native snapshot binary (0.2.8-next).
• CDN and origin Drive9 checksum manifests agree for all five ti targets. CDN, origin, and GitHub mirror version files report c6e057f.
• Downloaded the real Darwin arm64 companion, verified SHA-256 3dee65b3a28815c7779cc0d3eb46aa49a92717048707a003154eb50674f72771, ran version, and checked layer fork/chain/delete and mount --layer/--checkpoint capabilities.
• Ran the unchanged installer for v0.2.7 in an isolated temporary home/install directory. It successfully installed ti 0.2.7 and Drive9 c6e057f with checksum and capability verification, demonstrating the documented reinstall option.
• sh -n scripts/install.sh, new local documentation links, and git diff --check passed.

The additional real updater probe stopped at GitHub's unauthenticated API rate limit (HTTP 403); same-version early return is confirmed from source. Authenticated cloud live-e2e and Windows runtime validation were not run. The release guide keeps the full live suite as a prerequisite before publication; local checks do not prove live mount behavior.

After merge and completion of release validation, tag the intended merged commit and push refs/tags/v0.2.8 to trigger release.yml. This PR does not create a tag or publish a release.