v0.2.9

Withdraws v0.2.1–v0.2.8. GitHub's auto-attached source archives for those tags included a real household hostname and a live Iroh endpoint id in pairing tests. The attached binaries were clean; this tag is the first whose source zip matches the scrubbed tree.

Also:

• Pairing tests use fictional hostnames and a dummy endpoint id
• Release workflow publishes assets once (no duplicated changelog)
• Child leave still requires parent Allow
• Schedule, lock, and grants no longer wait on the mesh

Bins for x86_64 and aarch64 (hearth-0.2.9-<triple>.tar.gz).