release: publish v0.9.0

[GazaliAhmad]

Summary

Prepare causal-order for the v0.9.0 package release and align the public docs, website, and release notes with the finalized deployable runtime surface.

Why

This closes the 0.9.0 stabilization milestone so the package can be published without tentative release wording, stale public docs posture, or pre-1.0 ambiguity leaking into the surfaced API and website.

• it finalizes the package metadata, docs wording, generated API surface, and public website framing for v0.9.0
• this belongs to the 0.9.0 release lock work after the 0.9.0-a, 0.9.0-b, and 0.9.0-c cleanup passes

Included

• bump package metadata and lockfile to 0.9.0
• add v0.9.0 release notes and changelog entry
• align README, roadmap, guides, wiki, website metadata, SEO, and structured data around the deployable event-ordering runtime posture
• finalize public API wording and generated website API data for the 0.9.0 surface
• remove stale repo-only/design leakage from public website docs paths
• remove the one-off Python PWA icon generator and narrow CodeQL Advanced to JavaScript/TypeScript plus GitHub Actions
• regenerate package footprint metadata and badge

Not Included

• npm publishing itself
• new runtime capabilities or protocol behavior
• new incident simulations or network-defense functionality
• post-1.0 compatibility removals beyond the documented 0.9.0 surface decisions

Verification

npm run docs:check
npm --prefix website run docs:api
npm pack --dry-run

Website note: local full website build was not rerun here because the existing local website/dist / .astro files were file-locked on Windows, but docs-sync/source validation passed and the npm package dry run completed successfully.

Docs

• README
• CHANGELOG
• ROADMAP
• MAINTENANCE
• RELEASE_PROCESS
• COMPATIBILITY
• guides
• website
• no docs change needed

Checklist

• scope stays focused
• verification matches the change
• docs and release wording are aligned when needed
• no unrelated changes were bundled in casually