v2.0.9

Remove the offline policies CLI command and the role_policy / trust_policy generators from tcdeploy.py (#49). The CLI now exposes only deploy and check-auth.

IAM provisioning definitions remain in the private v6-services-iac repository. Usage, migration and authentication documentation now explains that roles and boundaries must be provisioned independently before application deployment.

The restrictive STS session policy remains in place. This release does not change deployment permissions, manifest schemas, image scanning, runtime secret handling, health checks, or production approval requirements.

Compatibility: tooling that called the removed policy generators must use the reviewed IaC definitions instead. Existing application deploy/check-auth consumers remain compatible.

Validation: all 102 tests passed in the pinned CircleCI AWS executor, including the real AWS CLI parsing check; shell syntax checks passed. Master CI passed at the release commit.

Pinned commit: dc06de730f068a230efa9d5f4d4d9c80782d3bfb