Release FixMap v0.8.9 reliability sweep

[aryamthecodebreaker]

What changed

• fixes and verifies every currently open FixMap issue from bug: Go func declarations never count as definition sites, so Go repos lose the 24-point definition boost #500 through bug: detectPackageManager only reads root lockfiles, so a Yarn/pnpm workspace gets npm test routes #627, excluding already-closed bug: fixmap_compare is the only MCP tool that does not reject unknown arguments despite declaring additionalProperties: false #542 and bug: the word "please" alone flips a specific task to vague, hard-capping every file to low confidence #599
• audits all 30 findings in the attached v0.8.8 review and records fixes, expected behavior, or rejected premises
• adds /fixmap setup and the complete feature catalog, Validate, strict Verify warning gates, MCP/Action cache controls, and cross-language/workspace hardening
• hardens ranking, grounding, caching, exclusions, remote repositories, Markdown, credentials, GitHub API/output limits, workflows, release metadata, and generated artifacts
• redesigns the website and updates README, changelog, evidence, release notes, social drafts, and the post-release checklist
• bumps every release surface to 0.8.9
• pins Vite 6.4.3 so the claimed Node 20.11 floor is both testable and free of the high-severity advisory found during release verification

Why

The published v0.8.8 package had a large confirmed reliability backlog across CLI, core, MCP, Action, CI, evidence, documentation, and the website. This release resolves the full reviewed scope and adds traceable regression proof.

Verification

• Node 20.11: four TypeScript projects and 697 tests
• Node 22: four TypeScript projects and 697 tests
• Node 24: full npm run ci
• full npm audit: 0 vulnerabilities
• external and held-out FixMap gates match recorded results
• external and held-out BM25/lexical/path baselines match recorded results
• adversarial suite: 9/9, false-confidence rate 0
• 1,000-file benchmark gate
• dry-run and fresh install of both 0.8.9 npm tarballs
• installed CLI version/features/Plan/Validate smoke
• shared Core/browser export smoke
• real MCP initialize handshake at 0.8.9
• production Next build and nine-route HTTP smoke
• generated Action and rendered documentation parity
• version, diff, and credential audit

The issue-to-fix-to-test ledger is in docs/releases/v0.8.9-issue-verification.md.