v1.9.0-rc.4

Fourth release candidate for v1.9.0. Cut from protected main at
c41149eaacab353c82403477bf0c5b2f26a48650 (release record PR #33), carrying the
non-coder workflow audit remediation merged in PR #32
(f22c67b277cc6005d8217410b4ab7aa56827b846).

What changed since rc.3

• Every issue-form flow answers the submitter on every exit — script rejections in
  plain English, a catch-all comment with the exact Workflow permissions click-path
  when the pull request itself is refused, dedicated replies for already-exists /
  nothing-changed / closed states, and "Updated the pull request from your edit" on
  issue edits instead of a repeated first-time comment.
• Downstream updater legibility — a step summary for every way a run can end, and
  "already up to date" is now a reachable green no-op (re-recording an unchanged release
  preserves the version lock's original recorded_at). The tag gate is a whole-string
  match, closing a GITHUB_OUTPUT injection window.
• New missing-label workflow flags issue-form submissions whose content:* label
  was dropped because Bootstrap labels never ran.
• Scheduled workflows explain themselves when their module is off and post
  what-to-do summaries on failure; the verification sweep caps its listing and can be
  run manually.
• Setup wizard repository guard — derives the repository from the *.github.io
  address it is served on and refuses, case-insensitively and only on a positively
  detected copy, a configuration still pointing at the template repository.
• Docs — docs/launch.md is the single settings walkthrough; docs/admin-guide.md
  gains bot-PR and scheduled-workflow troubleshooting; the repository transfer
  procedure is a numbered checklist.

Full details: CHANGELOG
and the release-readiness status.

Known notes

• Seven open CodeQL annotations on PR #32 are documented false positives awaiting
  maintainer dismissal (six test-assertion URL-substring flags, one by-design
  http-to-file-access in scripts/metrics.mjs); reasoning is recorded on the PR.

Rollback point

v1.9.0-rc.3 at a9741c9845e0928ec6b6654e6e04b6ebe71c2233.

🤖 Generated with Claude Code