chore(release): v5.8.2 pins + changelog — week one on the wizard (gh-#745, gh-#722, gh-#724)

[genwave-radio]

Release chore for v5.8.2 · PLAN T467 · the #748 shape.

✅ What changed

• compose.pinned.yaml: every image home-v5.8.1 → home-v5.8.2.
• CHANGELOG.md: the v5.8.2 entry — gh-Ads: approved spots render one per 10-minute worker tick — approving several in the wizard looks like nothing happened #745 (approved spots drain every tick, Approve names the render window), gh-Ads: retiring a spot through the API leaves its media row eligible, so the retired spot keeps airing #722 (retire takes the spot off the air), gh-Ads API: a failed write/preview job loses its kind — the wizard cannot tell which step failed #724 (a failed job says which step failed, db/47), plus the merge-guard hook path (gh-toolkit: add a MERGE RULE PreToolUse guard (block gh pr merge, git tag, push to main) #751). Follow-ups noted: gh-admin-ui: toasts never mount on the production build (dev server is fine) #765, gh-ads: one shared retirer for the controller and the worker's stale sweep #767. Abstractions unchanged (package diff vs 5.8.1 empty).
• tools/check-doc-drift.sh green: pins all on home-v5.8.2.

🗄️ Upgrade note

db/47 is additive (ADD COLUMN IF NOT EXISTS station.ad_spot.job_failed_kind), applied by migrate.sh on the way up like every other migration. No backfill: a job that failed before the upgrade keeps its error but shows on neither wizard step until the next job runs. setup.sh's marker check will say "db/47 adds no new table" — expected.

🚦 Order

1. Merge this PR (Dean).
2. git tag v5.8.2 && git push origin v5.8.2 (Dean's word, per the release rule).
3. Demo: git pull && ./launch.sh --pinned.

Do not merge without Dean.