Clarify credential redaction and tool registration in release notes

docs/releases/v0.8.0.md

@@ -24,8 +24,8 @@ continue to have separate outcomes.
   never published; published versions and their contents remain immutable.
 - Records preserve exact endpoint and path bytes. Ordinary UTF-8 evidence uses
   record format 1; format 2 preserves other bytes. Recovery diagnostics redact
-  credentials, while private records and typed evidence can contain sensitive
-  endpoints. Operators control record retention and removal.
+  HTTP(S) URL userinfo, while private records and typed evidence can contain
+  sensitive endpoints. Operators control record retention and removal.
 
 ## Consumer tools and compatibility
 
@@ -36,7 +36,8 @@ storage failure is reported separately and does not change the publication
 result. Applications handling results should inspect `RecordError` when a saved
 recovery handoff matters.
 
-Consumers using a module-selected CLI can run it with `go tool releasekit`.
+Consumers with the CLI registered as a Go tool in their module can run it with
+`go tool releasekit`.
 The maintained multi-module launcher and Woodpecker examples use the selected
 module's tool version. Register the CLI before generating a vendor tree when
 using a vendored tool. Older recovery CLIs that only support record format 1