0.9.0

Fixed

• Sync the attested-release permission + Syft contract into every
  consumer-facing surface. 0.8.1 added artifact-metadata: write to the
  attesting jobs and bumped Syft to 1.46.0 in the workflows and release
  validator, but the caller-facing docs, examples, and catalog still showed
  the old three-scope set and Syft 1.42.3. Because a caller's GITHUB_TOKEN
  permissions are the ceiling for a reusable workflow, a consumer copying the
  stale three-scope example under-scopes the attest step. Update the
  release-supply-chain.yml caller permissions in README.md,
  examples/public-oss/release.yml, and docs/04/docs/09; add
  artifact-metadata: write to the artifact-attestations,
  slsa-build-provenance, and attested releases-packages capabilities in
  catalog/capabilities.yml; correct the Syft version in README.md,
  docs/07, and docs/13; and add a 0.8.1 caller migration note. Contract-
  truth synchronization only — no workflow behavior change.

• Remove volatile GitHub tariffs from the ci-free-tier-planner skill and
  guard against regression. .agents/skills/ci-free-tier-planner/SKILL.md
  hard-coded plan quotas (Actions minute allowances, storage/cache sizes, and
  the attestation / dependency-review / secret-protection / environment plan
  gates), contradicting the project rule that volatile plan/price/quota facts
  live only in the freshness-enforced catalog/product-facts.yml. A product
  fact could expire and correctly redden the ledger while the skill still
  served the stale number. Rewrite section 4 to hold the durable procedure and
  reference the facts by id (github-actions-*, github-attestations-*,
  github-dependency-review-*, github-secret-scanning-*,
  github-environments-*, github-code-quality-transition) with fail-closed
  resolution, and add a check_skills.py guard (with self-test) that fails CI
  if any SKILL.md reintroduces a comma-grouped allowance, <n> minutes, or a
  storage-size figure. Regenerate the .claude/skills mirror. Found by an
  independent forensic review (RVR-P2-010).

• Harden the runtime-coverage honesty gate against weak and stale proofs.
  validate_runtime_coverage.py accepted any https URL for a
  runtime-proven record (its own fixture used example.invalid), so a docs
  page or a foreign-repo run would have passed, and it never noticed that the
  release-supply-chain.yml record still pointed at a 0.7.0 run
  (…/29165402032 at eda8ff7) taken two edits before the current file.
  Require last_run to be a
  github.com/NDDev-it-com/nddev-ci-workflows/actions/runs/<id> URL and add a
  proven_digest (sha256 of the workflow file at the proving run) that the
  validator recomputes and matches, so any later edit to a proven workflow
  reddens CI until it is re-run and re-recorded (or downgraded) instead of
  silently keeping the label. Repoint all three runtime-proven records to runs
  that provably executed the current bytes (actionlint / zizmor-sarif → the
  ci.yml run …/29172553315; release-supply-chain → the 0.8.1 release run
  …/29167958787 at 8b8e3ea) and record each digest. Fixtures now cover
  foreign-URL, non-run-URL, missing-digest, and stale-digest. Found by an
  independent forensic review (RVR-P2-009).

• Bound the optional runtime bundle to the SBOM-covered source archive
  (RVR-P2-011). release-supply-chain.yml and its byte-parallel free twin
  attach an optional second runtime_paths bundle that received a
  build-provenance attestation but no SBOM — and because runtime_paths was
  validated independently of archive_paths, it could ship tracked files the
  Syft scan of the source payload never saw. Enforce runtime_paths ⊆ archive_paths inside the deterministic-bundle program (both variants,
  byte-identically) so every file in the runtime bundle is also in the source
  archive that sbom.spdx.json inventories — the source SBOM is now provably a
  superset of everything the release ships. Add a check_release_supply_chain.py
  fixture (the runtime-bundle program was previously the one embedded program
  with no hermetic test) covering subset-accepted and outside-archive / absolute
  / unmatched / empty-archive-refused. The release-supply-chain.yml
  runtime-coverage record drops to static-only (its contract validator stands
  in) until the next release re-proves it live. Found by an independent forensic
  review.

Changed

• Catalog tool inventory + currency (catalog/tools.yml). Add the seven
  in-use actions that were absent from the catalog — actions/setup-node,
  actions/setup-go, actions-rust-lang/setup-rust-toolchain,
  actions/setup-dotnet, actions/setup-java, hashicorp/setup-terraform,
  and aquasecurity/trivy-action — and correct github/codeql-action's
  used_by (it also runs in zizmor-sarif.yml and public-scorecard.yml).
  Bump drifted pins to latest across the workflows and catalog in lockstep:
  codeql-action v4.36.3→v4.37.0, lychee-action v2.8.0→v2.9.0, labeler
  v6.1.0→v6.2.0, stale v10.3.0→v10.4.0, setup-java v5.4.0→v5.5.0, and the
  documented semgrep CLI version v1.168.0→v1.169.0. All remain full-SHA pinned
  with # vX.Y.Z comments; no workflow behavior change.