chore(release): bump to 0.8.31

- workspace.package.version: 0.8.30 → 0.8.31
- per-crate path-dependency version pins: 0.8.30 → 0.8.31 (31 entries)
- npm/deepseek-tui: version + deepseekBinaryVersion → 0.8.31
- Cargo.lock refreshed via `cargo update --workspace --offline`
- CHANGELOG: [Unreleased] → [0.8.31] - 2026-05-12 with theme paragraph
- new [Unreleased] anchor + [0.8.31] compare link

Verified with `./scripts/release/check-versions.sh`:
  Version state OK: workspace=0.8.31, npm=0.8.31, lockfile in sync.

Verified parity gates green pre-bump (see prior commits) and
post-bump (cargo fmt --all --check, cargo clippy --workspace
--all-targets --all-features --locked -- -D warnings).

crates/execpolicy/Cargo.toml

@@ -8,5 +8,5 @@ description = "Execution policy and approval model parity for DeepSeek workspace
 
 [dependencies]
 anyhow.workspace = true
-deepseek-protocol = { path = "../protocol", version = "0.8.30" }
+deepseek-protocol = { path = "../protocol", version = "0.8.31" }
 serde.workspace = true