Finalize RegistryStack v0.9.0 source refs

[jeremi]

Summary

Finalize beta-11 source provenance after prepare PR #340 squash-merged as 89b6a69981fb9b67f1158a5ef7f404dc01e0f23c.

This PR changes only:

• release/manifests/registry-stack-beta-11.yaml stack.source_ref
• all seven v0.9.0 monorepo archive refs in docs/site/src/data/docsets.yaml
• the generated docset mirror

No release tag or canonical image was created.

Verification

• release/scripts/registry-release validate release/manifests/registry-stack-beta-11.yaml
• python3 -m unittest release/scripts/test_registry_release.py (43 tests)
• npm run generate
• npm run check:docset
• DOCS_DOCSET=v0.9.0 npm run check:docset
• git diff --check

Before merge

• Required CI passes
• Source-ref and warning classification audit passes
• Protected main remains at the prepare squash commit

After merge and before tag

• Execute the documented v0.8.4 to v0.9.0 upgrade and rollback exercise
• Execute the evidence-grade signed-bundle, signer-custody, antirollback, and cursor gate
• Run the final release matrix from a fresh worktree
• Confirm no local or remote v0.9.0 tag exists

Publication hold

Keep hosted-publication-held. The source beta may ship, but hosted first-run publication remains blocked on #330 and #198.

[jeremi]

Independent finalize audit passed at bd3a7f2fb18b299feb709314a5b454513e0f4bbe.

Verified:

• sole parent is prepare squash/current protected main 89b6a69981fb9b67f1158a5ef7f404dc01e0f23c
• diff is exactly the beta-11 manifest source ref, seven v0.9 docset refs, and seven generated JSON mirrors
• every ref resolves to the prepare squash SHA and no old freeze ref remains in those files
• generated JSON exactly matches the YAML serialization
• manifest validation and git diff --check pass
• the single warning remains hosted-publication-held -> hosted-gate-held
• DCO sign-off is present

Verdict: approve after required CI passes. No tag has been created.