chore(release): 0.9.0, lock urllib3 2.8.0

[blackaxgit]

Release prep for 0.9.0. It also turns main green again.

Why this PR

After #68 merged, main's Dependency audit failed. pip-audit flagged urllib3 2.7.0 with CVE-2026-97687, CVE-2026-97688 and CVE-2026-97689, all fixed in 2.8.0. Because the audit failed, the docker job was skipped, so no image was published from fa68cdc.

urllib3 is dev-only here: pip-audit → requests → urllib3. uv export --no-dev does not include it, the wheel's Requires-Dist does not list it, and the image installs with --no-dev. The shipped artifacts were never affected.

Changes

• uv.lock: urllib3 2.7.0 → 2.8.0, plus the constraint recorded in the manifest. Nothing else changed.
• pyproject.toml: new [tool.uv] constraint-dependencies entry urllib3>=2.8.0. The rule in tests/test_dependency_floors.py is that every security floor is declared whether or not a runtime path reaches it, and pip's dev-only floor is the precedent.
• tests/test_dependency_floors.py: new SECURITY_FLOORS entry. With the floor removed, the test fails, which I confirmed.
• src/ssh_mcp/__init__.py: __version__ = "0.9.0".
• CHANGELOG.md: [Unreleased] becomes ## [0.9.0] - 2026-09-30, with a Why 0.9.0 and not 0.8.2 note. fix(config): reject non-list groups instead of coercing #68 makes string and inline-table groups configs refuse to start, and the 0.8.0 rule says that takes the minor. There is also a urllib3 Security entry.
• AGENTS.md: current version 0.9.0, and the test count is now 855.

Verification

• HYPOTHESIS_PROFILE=ci pytest: 855 passed.
• ruff format and check, mypy and bandit are clean. pip-audit finds no vulnerabilities, uv lock --check passes, and gitleaks is clean.
• uv build produces blc_ssh_mcp-0.9.0 as a wheel and an sdist.
• Simulating release.yml's tag assertion with v0.9.0 passes. The CycloneDX SBOM export works and does not include urllib3.
• Three-seat panel (fable 5.1, sol 6.1, grok 4.7):
  • A: WARN, no blockers. The notes cover every user-visible change since v0.8.1.
  • B: FAIL, because urllib3 had no floor. That is fixed, and sol re-checked it: PASS.
  • C: WARN, no blockers. The release path works for v0.9.0.

After merge

Push tag v0.9.0. PyPI publishing waits for the reviewer-gated pypi environment. GHCR publishing from the tag is not gated. github-release uses --generate-notes, so paste the 0.9.0 CHANGELOG section into the release body by hand: that section explains the breaking groups change, and the PR titles alone do not.