v0.0.9 — Production Hardening

What's Changed

• fix(dashboards): text-card review follow-ups — image block, types bump, shared full-width, bound-tool guards (#3138) by @msywulak in #3147
• feat(dashboards): KPI / scorecard card type (#3137) by @msywulak in #3149
• feat(integrations): cap-gated static-bot routing-id install spine (#3140) by @msywulak in #3148
• chore(deps): syncpack 14 → 15 (#3132) by @msywulak in #3150
• chore(deps): fumadocs-mdx 14 → 15 (apps/docs) (#3132) by @msywulak in #3151
• refactor(auth): drop redundant admin from user.role ACL — single-source tenant admins on member.role (#2890) by @msywulak in #3155
• feat(integrations): cap-gate Telegram static-bot install + flip available (#3141) by @msywulak in #3152
• feat(integrations): cap-gate Google Chat + WhatsApp static-bot installs (#3143, #3144) by @msywulak in #3153
• feat(integrations,chat): Microsoft Teams runtime branch + cap-gated install (#3142) by @msywulak in #3156
• fix(integrations): retire the residual uncapped Discord OAuth bypass (#3145) by @msywulak in #3160
• fix(admin): atomic last-admin guards + platform cross-workspace role change (#3158, #3157) by @msywulak in #3162
• fix(integrations): static-bot family disconnect/guard/webhook hardening + dead-table cleanup (#3154, #3161) by @msywulak in #3163
• fix(api): purge integration_credentials + twenty_integrations in hardDeleteWorkspace (#3168) by @msywulak in #3169
• fix(integrations): close static-bot routing-id concurrent-install race (#3167) by @msywulak in #3170
• fix(admin): complete the last-admin invariant — block native org endpoints + multi-workspace delete guard (#3164, #3166) by @msywulak in #3171
• fix(admin): /platform/users shows effective workspace member.role, fixing skipped demotion confirm (#3165) by @msywulak in #3172
• docs: fix verified accuracy drift surfaced by /docs-audit (v0.0.9) by @msywulak in #3193
• docs(www): privacy security blurb states no SOC 2/ISO cert held yet by @msywulak in #3173
• refactor(auth): remove the Better Auth admin plugin — direct-DB user ops + reproduced ban enforcement (#3159) by @msywulak in #3194
• fix(api): wire prod OTel export + span-name consistency cleanup (#3175, #3183) by @msywulak in #3195
• fix(api,plugins): runtime resilience — explore fall-through + orphan-task guard + twenty healthCheck (#3177, #3180, #3179) by @msywulak in #3196
• fix(api,docs,cli): v0.0.9 standalone cleanup — matchError label + migration/CLI/2FA docs (#3186, #3187, #3191, #3192) by @msywulak in #3197
• fix(api): SaaS boot-guard family — claimed-region scoping + ProviderKeyGuardLive + downgrade health signal (#3176, #3178, #3184) by @msywulak in #3198
• fix(api,mcp): cache /health plugin probes + init OTel in standalone MCP (#3201, #3199) by @msywulak in #3204
• docs(reference,www): v0.0.9 accuracy sweep — env contracts, error codes, blog nav (#3182, #3189, #3190, #3174, #3185) by @msywulak in #3205
• fix(api): provider guard & error-path correctness — boot-guard family (#3200, #3203, #3202, #3181) by @msywulak in #3206

Full Changelog: v0.0.8...v0.0.9