Release 2.9: repository hygiene and release source consolidation

[avksp]

Summary

• add a fail-closed repository hygiene policy and validator for current tree, all refs, forbidden roots, malformed history and bounded Git object reads
• remove tracked temporary release/ artifacts and make CHANGELOG.md plus GitHub Releases the canonical durable release history
• publish 2.9.0 package/plugin/documentation pins and a bounded redacted release-accounting fixture

Validation

• 2039 unittest tests passed, 1 expected platform skip
• policy-bound Ruff, format, mypy and branch coverage passed at the unchanged 76% floor
• module/package dependency and architecture complexity gates passed
• repository hygiene passed for HEAD and all local refs with history required
• neutrality scan returned zero findings
• publication versions and adoption passed for 2.9.0 / v2.9.0
• wheel and sdist installed and ran outside the checkout with resources and py.typed present

ALK evidence

• workflow state: COMPLETE, revision 30
• frozen plan: revision 11, digest 6dee4697970ea4777f0eb73fc5119978d45a9a5d468ae1b2de6968e839adc736
• final implementation audit: PASS
• independent final audit: PASS / READY_FOR_FINALIZATION, OpenCode GLM 5.3 session ses_fabc17fe4ffeu9Wp3Fb5JZSbed; Grok 4.6 xhigh attempt was quota-blocked and produced no verdict
• production promotion is not claimed; PyPI deployment remains a separate manual environment approval