fix: restore the 0.8.0 heading the changelog entry replaced

The Unreleased entry was written over `## 0.8.0 — 2026-07-19` instead of
above it, folding the shipped 0.8.0 section into Unreleased: the release
lost its extractable anchor, and the next cut would have republished its
notes as new work.

changelog-armed.sh passed on that tree — correctly, since it asks only
whether the top section agrees with VERSION, and Unreleased was still on
top. The gap it leaves is filed as #122.

Also quote the class check's failure list instead of relying on unquoted
word-splitting to print one path per line.

Refs #116

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
             <(git ls-files '*.sh' | sort -u))"
           if [ -n "$missing" ]; then
             echo "tracked scripts the shellcheck sweep does not cover (#116):"
-            printf '  %s\n' $missing
+            printf '%s\n' "$missing" | sed 's/^/  /'
             exit 1
           fi
           shellcheck -x "${files[@]}"

CHANGELOG.md

@@ -59,8 +59,6 @@ which records not just what changed but what each drill run proved.
   operator copy-pastes is as wrong as a role box executes, and it fails
   later and further from the cause.
 
-## 0.8.0 — 2026-07-19
-
 ### Fixed
 
 - **CI's shellcheck sweep never lints `.github/scripts/*.sh`** (#116) —
@@ -83,6 +81,9 @@ which records not just what changed but what each drill run proved.
   a shopt subtlety hides one. `eof_guard_sweep` itself carried the identical
   blind spot — it rebuilds the same glob — and is widened the same way.
 
+
+## 0.8.0 — 2026-07-19
+
 ### Added
 
 - **Merging the release PR IS the release — and the release re-arms main