chore(release): prepare envelopers 0.8.3

[tobyhede]

Prepares a 0.8.3 release. Version bump and changelog only — no code changes.

Why

The dependency fix that matters already landed on main in f61ad42, but was never published. main’s Cargo.toml still carried version = "0.8.2" — the same number as the published release — so crates.io continues to serve the old manifest.

	aws-sdk-kms req	default_features
crates.io 0.8.2 (2024-01-09)	^1.9.0	true
main (unpublished)	1.114.0	false, with default-https-client

With default features on, aws-sdk-kms pulls the deprecated rustls feature → aws-smithy-http-client’s legacy-rustls-ring → rustls 0.21 → rustls-webpki 0.101.7, which is affected by GHSA-82j2-j2ch-gfr8 (panic on a malformed CRL issuingDistributionPoint BIT STRING).

Downstream, cipherstash-suite cannot drop rustls-webpki 0.101.7 from its lockfile: setting default-features = false on its own aws-sdk-* deps is undone by feature unification, because envelopers 0.8.2 requests aws-sdk-kms with defaults. Publishing 0.8.3 is what unblocks that. Tracked as CIP-3779.

Why a patch bump

No public API change between 0.8.2 and main. The only source changes are an internal async-mutex → async-lock swap and one test assertion. Worth a reviewer’s eye: default-features = false does change which TLS client a consumer gets by default, so if you consider that consumer-visible, this should be 0.9.0 instead — say so and I’ll redo it.

Changelog gap

CHANGELOG.md has had no entries since 0.5.1; 0.6.x–0.8.2 shipped undocumented. I did not backfill those — the new entry covers only 0.8.2..0.8.3 and says so.

Verification

cargo metadata --locked passes: manifest is valid and Cargo.lock is consistent. I did not run a build or the test suite — the machine is at under 1 GB free disk. CI should be treated as the gate.

Not done

cargo publish has not been run. Publishing is public and irreversible, so that is left to a human.

https://claude.ai/code/session_012753nvQC2ku4Ar6s4qdaft

[freshtonic]

Approved. Cargo.toml and the package entry in Cargo.lock consistently prepare 0.8.3, and the packaged manifest retains aws-sdk-kms with default features disabled plus the intended default HTTPS client. The resolved graph contains only patched rustls-webpki 0.103.x, and CI test and benchmark checks are green.

Non-blocking documentation notes: the 0.8.3 changelog heading omits a release date, and several dependency bullets describe intermediate update versions rather than the final versions currently resolved in the release lockfile (for example aws-lc-sys is now 0.44.0 rather than 0.38.0). Updating those details would make the release notes more precise, but they do not affect approval.