Release v7.89.0

Added

• An opt-in cratis/playwright profile that declares a pinned, headless and isolated Playwright MCP server for exploratory browser checks. The installer and Pi do not register it yet, so each user registers it in their own MCP configuration; the profile documentation gives the command. (part of #364)

Changed

• The application rules now cover recurring design failures: whether an action is allowed is a read-model property rather than a client-side derivation, settings events record one decision each instead of a whole configuration object, each consumer scenario gets its own read model and dispatch never reads a UI model, provider clients stay behind reactors, a reactor never reacts to its own consequences, prompts live as content rather than string literals, and the third copy of a job shape becomes a shared template. (#411)