chore(release): prepare v0.14.9

[toasterbook88]

Release prep for v0.14.9, following the publish path documented at the top of .github/workflows/release.yml: bump the version constant, then tag. GoReleaser owns the GitHub Release.

Changes

• internal/buildinfo/version.go → 0.14.9
• docs/current-state.md regenerated via hack/refresh-current-state.sh
• Three summary goldens carry the version string and move with the constant. UPDATE_GOLDEN is only wired into the contract tests, not these, so they were updated directly.

Contents since v0.14.8

PR
#270	two cmd/axis tests self-isolate HOME/AXIS_HOME instead of relying on the caller, so a bare go test ./... no longer reads the operator's store
#271	install.sh installs system-wide by default, stages and validates before replacing, classifies the existing entry, and gains a committed regression suite (make test-install)
#272	fleet-test write-containment guard plus a build-tagged two-node facts smoke (make test-fleet)

Call out in the release notes

#271 changes install.sh's default target from $HOME/.local/bin to /usr/local/bin and removes the superseded user-local copy. That is user-visible behaviour for anyone who reinstalls. The increment is a patch to match the established cadence, but the behaviour change deserves prominence.

Verification

make test           42 packages ok
make test-install   36 assertions, 0 failed
verify-repo-truth   exit 0
gofmt / vet         clean

Two tooling defects found while preparing this

Neither is fixed here — flagging rather than widening a release PR.

hack/refresh-current-state.sh:131 runs go test ./... -count=1 unisolated. No HOME redirection, unlike make test. It fails on daemon tests that read the real ~/.axis, which blocks release prep on any machine with an existing store. The Makefile already solves this; the script should use the same pattern.

buildvcs stamping fails inside a git worktree. make build, make lint, and hack/refresh-current-state.sh all fail with error obtaining VCS status: exit status 128 when run from a git worktree. -buildvcs=false works around it. Worktrees are a normal Go workflow, so this affects any contributor using one.

Next

Merge, then git tag v0.14.9 && git push origin v0.14.9.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.