Prepare RegistryStack v0.9.0 (beta-11)

[jeremi]

Summary

Prepare RegistryStack beta-11 as v0.9.0 from frozen source commit 705ed0b33490f0494cc60eb4786093e364000b4f.

This is a pre-1.0 minor release, not v0.8.5. The release intentionally removes previously published Relay and Notary HTTP surfaces and tightens configuration and trust contracts, so a patch version would incorrectly imply backward compatibility.

Included

• set all 26 workspace package versions and 22 path constraints to 0.9.0
• add release/manifests/registry-stack-beta-11.yaml
• add the release notes, product changelogs, migration notes, and the v0.8.4 to v0.9.0 upgrade/rollback exercise
• add the v0.9 docs archive metadata and retain the hosted-publication hold
• update Registryctl installer and documentation defaults
• document the signed-bundle first-boot sequence and version-specific antirollback restore requirements
• refresh Relay and Notary OpenAPI artifacts
• document the exact ten governed trust headers across applicable Relay routes
• update release tooling validation for the v0.9 image lock
• fix live Relay test and OIDC lab configurations for required deployment.profile

The seven monorepo archive references intentionally point at the frozen source commit in this prepare PR. The finalize PR must replace them with this PR squash commit before tagging.

Compatibility boundary

The explicit v0.8.4 OpenAPI comparison reports only the expected removals:

• Relay: 26 removed paths
• Notary: 3 removed admin configuration paths
• no additional schema or contract changes reported by the comparison

Migration and rollback requirements are documented in release/exercises/upgrade-v0.8.4-to-v0.9.0.md.

Verification completed

• full locked Rust workspace format, check, clippy, and test matrix
• Relay all-features matrix
• cargo deny
• Relay and Notary OpenAPI generation, exposure, and contract checks
• release helper test suite, 43 tests
• source model suite, 10 tests
• all beta manifest checks
• import audit and release-note drift checks
• docs install, 76 tests, full build/check, all archives, and 382,257 links/assets
• Registryctl source-built Docker tutorial
• full Lab release harness from a fresh detached worktree, including core, federation, Notary client, demo client, live PostgreSQL, Relay Zitadel, OIDC Relay, and OpenFn
• targeted TLS PostgreSQL snapshot tests after correcting the live fixtures
• independent security and release-contract review

The external OpenCRVS DCI smoke was not run because its external credentials are unavailable.

Required before merge

• Tier-C maintainer review of public trust and security documentation
• Required branch protection and CI checks pass on this PR

Required after merge and before tag

• Open the finalize PR and replace the manifest and seven docs archive source references with this prepare PR squash commit
• Execute the documented v0.8.4 to v0.9.0 upgrade and rollback exercise
• Execute the evidence-grade signed-bundle, signer-custody, antirollback, and cursor gate
• Run the final release matrix from a fresh worktree
• Tag only after finalize merges, then verify published assets, signatures, provenance, and repeatable builds

Publication hold

Keep hosted-publication-held. The source beta may ship, but hosted first-run publication remains blocked on #330 and #198.

[jeremi]

Release-candidate SBOM/Grype review found fixable runtime-base advisories after CI completed. #341 refreshes the Relay and sidecar bases and removes unused npm tooling from the sidecar image.

I moved this prepare PR back to draft until #341 merges. After that, this branch must be rebased onto the new main, the beta-11 source references must move to the new freeze SHA, and the release matrix and candidate image evidence must be refreshed.

[jeremi]

Tier-C maintainer security review record for the refreshed prepare head 18dbcaf:

• Reviewed public trust, security, migration, release-note, and archived-doc changes against the implemented contracts.
• Required deployment.profile behavior is documented for Relay and Notary.
• Removed configuration HTTP/apply surfaces are not presented as available.
• The signed-bundle first-boot sequence distinguishes stateless registryctl verification from product verification after accepted state exists.
• Version-specific antirollback backup and restore requirements are explicit; deletion or reinitialization is not presented as rollback.
• The five added governed scopes and exact ten trust headers remain aligned with runtime and OpenAPI contracts.
• Relay /ready audit exclusion, strict parser behavior, and Relay-only quarantine wording remain accurate.
• hosted-publication-held remains explicit for Hosted credential tour rejects documented demo identity #330/Verify the v0.8.4 first-run experience end to end as a fresh reader #198.
• Candidate image advisory remediation merged separately in fix(release): harden v0.9 image bases #341 and the refreshed three-image scan has zero fixed-version high/critical findings.
• No security invariant or release-contract blocker remains in this PR.

Maintainer review result: approve after the refreshed required CI checks pass.