Release v0.9.0

Summary

Give hosts an explicit, portable source mapping so generated evidence can retain stable project-qualified identity independently from the path shown to users. Existing SourceRoot consumers and generated output remain compatible.

Added

• Add immutable source-path policies, project source contexts, and typed stable file identities with fail-closed path validation. (#21)
• Add project-aware evidence APIs and deterministic canonical ordering for same-display files from different projects. (#21)

Changed

• Use explicit source identity in Vogen evidence when a host supplies it, without adding a Vogen runtime dependency or changing display paths. (#21)
• Validate public package compatibility against the released 0.8.0 baseline. (#21)