chore: prepare pishoo v0.8.0-beta.6

[eareimu]

Summary

• prepare pishoo v0.8.0-beta.6 while keeping gateway v0.8.0-beta.5 unchanged
• make pishoo-common follow the pishoo source version and publish it as 0.8.0~beta.6-1 for DEB/RPM
• bound pishoo's common-package compatibility from the last published 0.5.1-1 through the current pishoo package version
• use dhttp as the non-macOS worker group, create it from Linux package hooks, and retain _www on macOS
• restore the implicit identity-profile db/access.db policy fallback while preserving strict explicit/corrupt database failures
• pin release tooling to genmeta-xtask-release v0.2.0-beta.10

Release plan

• incremental preview release
• components: pishoo v0.8.0-beta.6, pishoo-common v0.8.0-beta.6, unchanged gateway v0.8.0-beta.5
• preview DEB/RPM/Homebrew plus GitHub prerelease assets
• publish only after gmutils v0.8.0-beta.6 completes to avoid shared preview repository metadata races

Verification

• nightly formatting for the product workspace and xtask
• locked product and xtask tests
• all-target/all-feature clippy for the product workspace and xtask
• release-contract tests for common-version following, literal lower/self upper bounds, rendered DEB/RPM requirements, and Linux worker-group hooks
• local x86_64/common DEB and RPM package builds; inspected pishoo-common 0.8.0~beta.6-1, pishoo dependency bounds, and dhttp group installation hooks

Remote S3 dry-runs and Homebrew packaging are PR-CI-owned because they require release credentials and a macOS runner; all required release jobs passed. Full uv run tests --release in genmeta-test was explicitly skipped for this release by release-owner approval on 2026-07-18. Product merge is gated by the repository-local verification above and this PR's required release CI.

Annotated tag message

pishoo v0.8.0-beta.6

Changed

• Use dhttp as the default pishoo worker group on non-macOS systems while retaining _www on macOS; DEB and RPM installation hooks create the dhttp group when needed.
• Publish pishoo-common from the same 0.8.0-beta.6 source version as pishoo. Linux packages render it as 0.8.0~beta.6-1, and pishoo accepts common-package versions from the last published 0.5.1-1 through the current version.

Fixed

• Restore the identity profile db/access.db as the default access-policy source for identity services without an explicit access_rules directive.
• Fall back to an empty policy only when the implicit database is genuinely absent; keep explicit, unreadable, corrupt, and invalid databases as service-preparation failures.

Components

• pishoo v0.8.0-beta.6
• gateway v0.8.0-beta.5 (unchanged)
• pishoo-common v0.8.0-beta.6 (0.8.0~beta.6-1 in DEB/RPM repositories)

Release surfaces

• Preview DEB, RPM, and Homebrew packages
• GitHub prerelease and packaged release assets