Classic automation tokens are deprecated; the trusted publisher for
release.yml is configured on npmjs. Node 24 + npm@latest satisfy the
npm >= 11.5.1 requirement. Also: release 2.9.0 version bump + changelog,
and ignore untracked advisor plans/ in prettier (eslint already does).