[codex] Draft sbom-diff-and-risk v0.8.0 release notes

[stacknil]

Brief Design Summary

This PR adds draft sbom-diff-and-risk v0.8.0 release notes focused on policy decision explainability.

The draft captures the current v0.8 direction:

• additive JSON policy decision explanation fields
• reviewer-facing policy decision interpretation guidance
• report and policy schema documentation updates
• unchanged summary.policy behavior
• production PyPI intentionally deferred

This PR only drafts release notes. It does not bump package version, create a tag, create a GitHub Release, publish to PyPI/TestPyPI, or change runtime behavior.

Files Changed

• tools/sbom-diff-and-risk/RELEASE_NOTES_v0.8.0.md

Validation

• git diff --check passed.
• Confirmed relative link targets exist.
• Broad Unicode Cf/Cc scan found no non-tab/newline control or format characters.
• Confirmed package metadata and runtime version remain 0.7.0.
• Confirmed no workflow files changed and no production PyPI workflow exists.
• No Python tests run because this is docs-only.

Out of Scope

• No runtime behavior changes
• No CLI behavior changes
• No workflow changes
• No package version bump
• No tag or GitHub Release
• No PyPI/TestPyPI publishing
• No production PyPI workflow