release: v0.68.0 — version material on the assembled WEBSERVE head

The assembled #272 head was code-complete but not release-shaped: at
fd296557 `Cargo.toml` read `version = "0.67.1"` and `CHANGELOG.md`'s first
section heading read `## [Unreleased]`. IR-54 puts that shape on the release
driver BEFORE the golden ref rather than after the run, so the tag, the golden
ref and main's tip stay one object.

- Version material: 0.68.0. Minor, justified by observable behavior:
  WEBSERVE changes what existing surfaces do — `/` now redirects to a
  node-prefixed index, docs move to a canonical `/<node>/docs/` with the bare
  paths kept as aliases, every non-empty send carries new envelope material,
  and an access-surface entry is retired.
- Cargo.lock refreshed workspace-only: 14 first-party line pairs by diff and
  nothing else, per the lockfile PROPERTY (IR-54) — the diff is the proof, not
  a count of version strings.
- `## [0.68.0]` changelog section covering W0-W3 and the `XFER` removal.
  Written from the RANGE, not the milestone narrative (IR-28): the four
  thin-lane bugfixes that ride `v0.67.1..fd296557` outside milestone #272 —
  releases#276, #277, #279, #280 — each have their own user-facing line,
  which the milestone story would not have produced.
- Regenerated docs (`cargo run -p xtask -- gen`), so the generated changelog
  page follows the changelog it is generated from; `xtask check` OK.

Zero `.rs` in this diff.

Co-authored by: deployah
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R1dpz1xXZdTeyjGeKDSbNW