RustBox 0.2.8 - final source validation

0.2.8 scope:
- authoritative IMAP folder totals/unread counters from server state, including selected-mailbox fallback via UID SEARCH UNSEEN
- optimistic/targeted realtime read/unread/flag updates without full message-list rerenders
- responsive total/unread folder badges, authoritative FolderStatus updates, and separate counter/CONDSTORE cursor handling
- IMAP cache/deep-index progress surfaced through the activity indicator
- content-type-aware opt-in security headers with external-script `script-src 'self'` CSP and stylesheet-only `style-src 'self'`
- private API no-store/nosniff/same-origin-CORP plus anti-framing CSP/X-Frame-Options; full document CSP, Permissions-Policy and COOP remain HTML-only
- pre-login auth policy minimized to rememberMeEnabled; optional feature policy requires authentication
- runtime migration V048 adds monotonic folder-counter generations on SQLite/MySQL/PostgreSQL; V049 remains next
- version metadata updated to 0.2.8

Completed in this environment:
- offline release validator: scripts/validate-release-static.py (279/279 checks passed)
- browser JavaScript assembled in manifest order passes `node --check`
- all JSON files parse successfully
- Python helper scripts compile successfully
- shell scripts pass `bash -n`
- release metadata consistently identifies 0.2.8
- V048 migration files/catalog registration and SQLite upgrade execution are validated offline


Not executable in this packaging environment:
- cargo fmt/test/clippy/build with Rust 1.99.1, because Rust/Cargo is not installed
- live PostgreSQL/MySQL/S3/NFS/OpenSearch/IMAP integration tests

The final release gate on a Rust host is:
  bash scripts/build-release.sh

This file intentionally does not claim blocked runtime/integration checks as passed.