chore(release): prepare v0.9.0

[owainlewis]

What changed

• bump the package and lockfile version to 0.9.0
• update the release-version fixture for v0.9.0

Why

Release the changes merged since v0.8.2, including unattended Pi job trust fixes, runtime and job-output hardening, and Slack mrkdwn formatting.

Validation

• bash tests/release-version.sh
• cargo fmt --all -- --check
• cargo clippy --locked --all-targets -- -D warnings
• cargo build --locked
• cargo test --locked
• git diff --check
• independent release review: approved