GhostBus v0.5.9 — hardening round 8: final sweep & posture doc

Hardening round 8 — the final sweep, and the posture document. This closes the eight-round hardening loop (v0.5.2 → v0.5.9).

The sweep found nothing new to fix — and shows its work. A fresh-eyes re-read of every route on every surface, then a purpose-built 71-probe hostile battery re-run against the current code on all five surfaces (single relay, hosted, MCP stdio, serverless, core): auth bypass attempts, the planted-registry escape, traversal IDs, prototype-pollution payloads through every state entry point, bus-bricking snapshots, MCP crash frames, numeric edges, body caps, and rotation immediacy on both hosted surfaces. Every probe landed as designed; Object.prototype canaries stayed clean throughout. The battery's single red was the probe's own wrong expectation (a paramless tools/call answers a clean JSON-RPC error — the codebase's convention), hand-verified on both transports. One examined non-fix, documented: deleting a workspace doesn't sever an already-open stream to it, but no route can reach the orphaned bus afterward, so the stream can only idle.

New: docs/security.md — the consolidated security posture, shipped in the tarball. Trust boundaries, every control family with its evidence, the load figures with their honest ceiling, and a "Known limitations — stated, not hidden" section. It closes with the mapping to the five steps an external review named toward 9/10: harden the security model — done; prove it under load — done; transactional persistence — deferred by the owner's explicit decision (the store stays an optional adapter, later); intelligent orchestration and coding-lifecycle integration — not hardening items, not claimed.

Consistency fixes: README's install line still said v0.5.0 (now v0.5.9); a docs example showed workspace keys as 64 hex chars (they've been 48 / 192-bit all along). Every number in the docs was audited against the code.

Loop end state: main suite 71 checks, serverless 12, both demos green, pack gate green (22 files). No suite padding in this round: a clean sweep adds evidence, not checks.

---

Correction (2026-10-11): this release's npm publish was blocked by the new pack-manifest gate — its parser assumed npm ≤ 11's output shape and npm 12 changed it, so the publish run failed the suite step and this version never reached npm. The gate did its job; the parser was the bug. Fixed and superseded on npm by v0.5.10 (see its CHANGELOG entry). The work described below ships in 0.5.10.