[quolu]

Summary

• Prepare Spotter 1.9.0 for the opt-in product-owned runtime-error sender in Add opt-in Spotter runtime error reporting to BugHub #5.
• Update package and lockfile versions and finalize the changelog.

Verification

• npm run verify:docs and focused reporter tests pass.
• Product full CI passed on macOS native, Linux workstation, and Windows native: https://github.com/kitepon/Spotter/actions/runs/37110951751
• The BugHub contract request and response HMAC vectors match exactly. A signed mock intake response advances the real store cursor; uncertain delivery does not.
• Final Windows credential format, private ACL readback, and isolated runtime collection through the Spotter-owned config passed Windows native CI: https://github.com/kitepon/Spotter/actions/runs/37111414075

Rollout boundary

Draft, stacked on #5. BugHub's LAN intake is deployed, but Fragile's per-terminal credential placement is awaiting a separate owner decision. Do not merge, publish, install, create Spotter reporting configs, or register hourly schedules until the owner approves Spotter release and four-terminal application. Reporting remains disabled by default.