Prepare SQLX v0.1.8 release

[openai0229]

What

Release preparation for 0.1.8, which carries the JDBC redaction fix (#19) and the local-database connection documentation (#20).

• Version 0.1.7 → 0.1.8 in Cargo.toml (workspace), Cargo.lock, java/jdbc/pom.xml, packages/npm-installer/package.json and the packaging scripts.
• .github/workflows/packages.yml: eight v0.1.7 references plus the release title literal.
• Skill compatibility moves to >=0.1.8, <0.2.0 in SKILL.md, references/install-cli.md and references/local-ui.md.
• scripts/jdbc-fixture.sh and the README build-from-source paths use the 0.1.8 JDBC jar.
• tests/updates.py: CURRENT 0.1.8, NEXT 0.1.9.
• docs/release-notes.md rewritten: the redaction fix and the README connection guidance.

Verification

$ cargo +stable fmt --all -- --check                                  # passed
$ cargo +stable clippy --workspace --all-targets --locked -- -D warnings   # passed
$ cargo +stable test --workspace --locked                             # nine test binaries, all passed
$ cargo +stable build --workspace --locked                            # target/debug/sqlx reports 0.1.8
$ python3 tests/distribution.py tests/installers.py tests/ui_lifecycle.py \
    tests/ui_distribution.py tests/ui_plugins.py                      # passed
$ python3 tests/updates.py                                            # passed with CURRENT 0.1.8 / NEXT 0.1.9
$ npm --prefix packages/npm-installer test                            # 22 passed, 0 failed
$ mvn -B -f java/jdbc/pom.xml verify                                  # BUILD SUCCESS, 2 tests

Risks and limits

• Nothing is published here. After the merge: annotated tag v0.1.8 on the merge commit, then gh workflow run packages.yml --ref v0.1.8 -f publish=true.
• The npm job still publishes with the repository NPM_TOKEN (expires 2026-12-17); npm ends bypass-2FA direct publishing in January 2027, so the job needs trusted publishing before then.
• The local page plugin is unchanged and keeps its 0.1.4 requirement.