chore(v9): release 9.0.0-rc.6

[github-actions]

🤖 I have created a release beep boop

9.0.0-rc.6 (2026-08-04)

Features

• Add payload serialization and response write spans to polling endpoints (#784) (3649353)
• Bound REPORT eval request body size with a 5 MiB default (#767) (984ccf3)
• Make usage metrics event publisher capacity configurable (#766) (cab4d51)

Bug Fixes

• Count serialized flags, and cover the serialize error paths (#794) (8da4829)
• deps: Bump go-server-sdk to v7.15.4, reverting v4 core libraries to v3 (#776) (bb920ab)
• deps: bump grpc, x/net, x/text to patch disclosed CVEs (#773) (719f049)
• deps: Bump OpenTelemetry dependencies to patch CVE-2026-41178 (#777) (b9519a7)
• Encode FDv2 stream events in a single jwriter pass (#757) (40a0c28)
• End auth span before invoking the next handler (#783) (c3719af)
• Redact end-user context from the url.path span attribute (#791) (9116839)
• Stop reporting response bytes that were never written (#792) (4d6c758)
• stop server-side stream replay producer when the SDK client disconnects (#774) (42ba69d)

Performance Improvements

• Resolve the tracer once per polling handler (#793) (62ec5cb)

---

This PR was generated with Release Please. See documentation.

---

Note

Medium Risk
Bundled changes touch request handling limits, streaming lifecycle, SDK serialization, and telemetry attribute redaction—not just version strings—so rc.6 carries moderate operational and observability risk despite this PR being metadata-only.

Overview
Release 9.0.0-rc.6 bumps the version in relay/version/version.go, .release-please-manifest.json, and documents the release in CHANGELOG.md. No application code changes appear in this PR; it packages work already merged since 9.0.0-rc.5.

Features: polling endpoints gain OpenTelemetry spans for payload serialization and response writes; REPORT evaluation requests are capped at a 5 MiB default body size; usage-metrics event publisher capacity is configurable.

Fixes & behavior: serialized-flag counting and serialize error handling; FDv2 stream encoding in a single jwriter pass; auth spans end before the next handler; url.path span attributes redact end-user context; response byte metrics reflect only bytes actually written; server-side stream replay stops when the SDK client disconnects. Dependency updates patch disclosed CVEs (grpc, x/net, x/text, OpenTelemetry) and bump go-server-sdk to v7.15.4 (reverting v4 core libraries to v3).

Performance: OpenTelemetry tracer resolved once per polling handler.

^{Reviewed by Cursor Bugbot for commit 45427b3. Bugbot is set up for automated code reviews on this repo. Configure here.}