CivicCast 1.0.0-rc9

CivicCast 1.0.0-rc9

1.0.0-rc9 is 1.0.0-rc8's baseline taken through a clean-Windows-VM fresh-tester
gauntlet and a full five-role GauntletGate, with every finding driven to zero.
No product feature changed — functional behavior is byte-for-byte rc8's.

What changed since rc8

• The release build no longer ships broken. rc8's tag build went red on a
  nonexistent action version and never published its unified manifest; rc9 fixes the
  pin, attests the merged manifest, adds a CI guard that resolves every action pin,
  and a post-publish check that the released asset set is complete + self-consistent.
• A second UI-thread freeze (a health probe polled on the UI thread) is now off-thread.
• A post-reboot installer button race that could skip the WSL warning is fixed.
• Doc-honesty narrowing, honest panic diagnostics, install-page asset naming +
  up-front SmartScreen guidance, WCAG-AA contrast, standardized pins, and new tests.

Full evidence + honest gaps: docs/releases/v1.0.0-rc9-verification.md.
Windows tester start-here: docs/tester/START-HERE.md.

Prerelease — not the beta declaration. A 24-hour soak (MSI machine + VMs) and a fresh
clean-VM install of this exact rc9 binary are the remaining steps before that call.