Bug-fix release targeting two user-facing issues found during the connection path audit (issue #709).

PRs to merge

• fix(connection): surface real IO error instead of 'db error' on connect failure #708 — fix(connection): surface real IO error instead of 'db error' on connect failure
• fix(ssl): implement sslmode=require without cert verification #711 — fix(ssl): implement sslmode=require without cert verification (was broken for any non-public-CA cert)

What's fixed

#708: Connection errors showed db error or error connecting to server with no useful detail. rpg now walks the error source chain and surfaces the real OS/network error, e.g. Connection refused (os error 111) or No such host is known — matching psql behavior.

#711: sslmode=require failed with TLS error: error performing TLS handshake against any server using a self-signed or non-public-CA certificate. The fix implements a no-verification TLS config (encrypt only, no cert check) — which is the correct psql semantics for require. Also improves error messages: SSL error: server does not support SSL (psql wording) when connecting with require to a non-TLS server.

Not in this release

• fix(ssl): sslmode=verify-ca and verify-full fail with UnknownIssuer when server does not send full chain #712 (sslmode=verify-ca/verify-full chain incompleteness) — harder fix, separate issue
• feat(wasi): WASI target for browser embedding via WSS proxy #700, feat(repl): interactive history picker for \s #701, test: boost unit test coverage from 68% toward 75% #702, feat(wasi): implement WSS client backend #706 (features) — not bug fixes

Checklist

• Both PRs CI green (currently: all pass)
• Merge fix(connection): surface real IO error instead of 'db error' on connect failure #708
• Merge fix(ssl): implement sslmode=require without cert verification #711
• Bump version to 0.8.1 in Cargo.toml
• Update CHANGELOG.md
• Tag v0.8.1
• GitHub release with binaries