zeroclaw: 0.7.5 -> 0.8.0

Big release with multi-agent runtime, schema v3, zerocode TUI, and security
hardening.

Changes:
- Bump to v0.8.0
- Update src hash, cargoHash, npmDepsHash
- Remove obsolete api-generated-stub.patch (upstream now ships it)
- Skip wiremock tests that fail in darwin sandbox (checkFlags)
  - Added 3 new commands::update::tests from v0.8.0

pkgs/by-name/ze/zeroclaw/package.nix

@@ -14,13 +14,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeroclaw";
-  version = "0.7.5";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "zeroclaw-labs";
     repo = "zeroclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hVHfsBw3u0CLWAbmizLA9ZrB+3B0qBIrSUuzsyChwW0=";
+    hash = "sha256-dB/M5QdAyql/WXxwkX9V/bkiRsAv0J+tIbQN0wKLJpM=";
   };
 
   postPatch =
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ln -s ${zeroclaw-web} web/dist
     '';
 
-  cargoHash = "sha256-6MGIJsaqRp3k/ysjdu6BE2iM2sehERQR+QoSqiThSpg=";
+  cargoHash = "sha256-ZBmz877jEkTGopa5QxNUguxxKO45aZ6K5GXXAv4Ii4s=";
 
   nativeBuildInputs = [
     pkg-config
@@ -50,6 +50,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # wiremock tests require socket binding, which is denied in the darwin sandbox
   checkFlags = [
+    "--skip=commands::update::tests::download_binary_preserves_missing_checksum_fallback"
+    "--skip=commands::update::tests::download_binary_rejects_checksum_mismatch_without_writing"
+    "--skip=commands::update::tests::download_binary_verifies_checksum_before_writing"
     "--skip=tests::exchange_pairing_code_posts_code_and_returns_token"
     "--skip=tests::fetch_pairing_code_reads_gateway_pair_code_response"
     "--skip=integration::telegram_attachment_fallback::"
@@ -74,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Fast, small, and fully autonomous AI assistant infrastructure — deploy anywhere, swap anything";
     homepage = "https://github.com/zeroclaw-labs/zeroclaw";
-    changelog = "https://github.com/zeroclaw-labs/zeroclaw/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/zeroclaw-labs/zeroclaw/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       drupol

pkgs/by-name/ze/zeroclaw/zeroclaw-web/add-api-generated-stub.patch

@@ -1,13 +0,0 @@
-diff --git a/src/lib/api-generated.ts b/src/lib/api-generated.ts
-new file mode 100644
-index 0000000..f6a1c72
---- /dev/null
-+++ b/src/lib/api-generated.ts
-@@ -0,0 +1,7 @@
-+// Stub for Nix build: api-generated.ts is normally produced by
-+// `cargo web gen-api` which runs the Rust gateway binary to emit an
-+// OpenAPI spec and pipes it through openapi-typescript.  Since we
-+// cannot run the gateway during the web build, provide minimal type
-+// exports.  These are compile-time only and do not affect the bundle.
-+export type paths = Record<string, never>;
-+export type components = Record<string, never>;

pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix

@@ -10,14 +10,7 @@ buildNpmPackage (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/web";
 
-  npmDepsHash = "sha256-DVL9kov8y1Eh3BM2Rpw+KbTDL6/AvT/epknM2X/Gf3E=";
-
-  # api-generated.ts is produced by `cargo web gen-api`, which requires the
-  # compiled Rust gateway binary — unavailable during the web build.  The two
-  # re-exported types are compile-time only (erased by Vite), so a minimal stub
-  # is sufficient.  Re-check on every bump: if upstream starts committing
-  # api-generated.ts or removes the import, this patch can be dropped.
-  patches = [ ./add-api-generated-stub.patch ];
+  npmDepsHash = "sha256-mwi93ZgXxb3xQnPPQHesR8YxQOxH8YaKBLGi/nEM8D4=";
 
   installPhase = ''
     runHook preInstall