GSH v1.9.0 - CLI Error Handling, License, Security Tooling

What's in this release

• Sentinel CLI error handling (#12, #16): clearer error messages, --log-level DEBUG tracebacks and a remediation hint, with new tests.
• Canonical Apache-2.0 LICENSE so GitHub detects it; research-use notice moved to NOTICE.md.
• README banner image and Zenodo concept DOI in CITATION.cff.
• Repo security: Dependabot version and security updates, CodeQL scanning, and branch protection on main.

Full Changelog: v1.8.0...v1.9.0