v3.9.0

• diff-aware is now the default on the surfaces that gate commits and PRs: the pre-commit scan (scan_staged / guardvibe-scan) blocks only newly-staged lines, and scan_changed_files reports only newly-added lines vs the base
• Opt out with --all-lines (CLI) or diff_aware:false (MCP); both report how many pre-existing findings were hidden (no silent drops)
• No rule or tool changes (441 / 37); gate green (PASS/A/0)