release: v0.8.2 — extension vault-creation fix (binary transport)

Extension-only patch: fixes vault create/attach in the browser extension, where
chrome.runtime.sendMessage silently dropped ArrayBuffer payloads (carrier JPEG →
0 bytes → opaque "no SOF marker found in JPEG"). See CHANGELOG for the full set.

- Version bumps: extension 0.7.0→0.8.2 (it had no changes in 0.8.0/0.8.1);
  relicario-core/-cli/-wasm 0.8.1→0.8.2 for unified-tag consistency. The Rust
  core/CLI are functionally unchanged from v0.8.1. relicario-server stays 0.1.1
  (independent version line; no functional change).
- CHANGELOG.md: v0.8.2 section. STATUS.md / ROADMAP.md: v0.8.2 landed, v0.9.0
  flagged as ready to kick off.

Verify: cargo build/test/clippy -D warnings all green (35 test binaries);
extension 435/435 vitest, build:all clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pe8qw5KePDqAEBsAxnVQuJ

CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## v0.8.2 — 2026-06-25 — extension vault-creation fix (binary transport)
+
+Fixes a bug that broke **vault creation and attach in the browser extension**:
+`chrome.runtime.sendMessage` serializes messages with a JSON-like algorithm that
+silently drops `ArrayBuffer` / `TypedArray` payloads — they arrive at the service
+worker as empty objects, so the carrier JPEG reached the steganography embed as
+**0 bytes** and failed with the opaque error *"no SOF marker found in JPEG."*
+Extension-only release; the Rust core/CLI are unchanged from v0.8.1 (versions
+bumped for tag consistency). `relicario-server` stays at `0.1.1`.
+
+### Fixed
+- **Binary-safe message transport** (`extension/src/shared/message-binary.ts`):
+  `encodeBinary` / `decodeBinary` deep-walk every request/response and base64-
+  envelope each binary buffer so it survives the channel (chunked base64 to avoid
+  call-stack overflow on multi-MB attachments/backups); plain `number[]` arrays
+  are left untouched. Applied at all four message boundaries — popup, service-
+  worker `onMessage`, setup wizard, and the vault tab.
+- **Actionable carrier-image errors**: `handleCreateVault` now magic-byte-checks
+  the carrier and returns `carrier_image_empty` / `carrier_image_not_jpeg` (with
+  user-facing copy) instead of the opaque WASM error when a non-JPEG or empty
+  file is selected.
+- **Setup-wizard message allowlist**: the service-worker router now permits
+  `create_vault` / `attach_vault` / `generate_recovery_qr` from the setup page
+  (the Phase-3 wizard sends these and they were being rejected as
+  `unauthorized_sender`).
+- **Vault-tab layout**: the closed detail drawer no longer reserves layout width
+  (the list + empty state center correctly), and the locked vault tab grows to
+  full width instead of pinning left.
+
 ## v0.8.1 — 2026-06-20 — org item-type parity + collection-scoped attachments
 
 Brings `relicario org add` / `relicario org edit` to **full item-type parity** with the