chore: prepare 0.9.0 release

[skvark]

Summary

• bump the root githits CLI from 0.8.0 to 0.9.0
• bump @githits/mcp from 0.6.4 to 0.9.0 for the public MCP behavior shipped since its last release
• align the MCP registry package reference and all generated plugin/extension manifests
• update the public code and package skills for Terms of Service remediation and bounded search/grep recovery

Release highlights

GitHits 0.9.0 adds canonical account settings and Terms of Service workflows:

• githits settings show|get|set|clear
• githits settings terms and githits settings terms accept
• typed, selective settings updates with stable JSON output
• one bounded OAuth refresh/retry for stale terms claims, without refresh loops for opaque ghi-* credentials
• shared CLI/MCP TERMS_ACCEPTANCE_REQUIRED remediation with legal and authenticated acceptance URLs

The coordinated MCP release also includes:

• bounded search_status waiting and explicit unchanged-search retry prevention
• actionable empty-grep recovery and human-readable truncation diagnostics
• preserved backend hints, alternatives, estimates, freshness, and not-found metadata
• consistent terminal-state handling across CLI, MCP text, and JSON output

Other user-visible fixes since 0.8.0 include non-blocking OAuth callback shutdown in proxied/sandboxed environments and the Undici 7.29.0 security update.

Validation

• bun run plugins:generate
• bun run plugins:check
• bun test — 2,675 passed
• bun run lint
• bun run typecheck
• bun run build
• bun run validate:packages:mcp-publish
• bun run smoke:cli — 70 authenticated/live steps passed
• bun run smoke:mcp — 38 authenticated/live steps passed
• bun run smoke:cli:built
• bun run smoke:mcp:built
• Codex and Claude skills-surface agent evals — both succeeded with high confidence and no tool or instruction issues
• npm pack --dry-run --json — confirmed githits@0.9.0
• mcp-publisher v1.7.9 validate server.json — checksum verified and manifest valid
• registry domain proof and OAuth metadata returned 200; unauthenticated MCP returned the expected 401 resource-metadata challenge
• git diff --check

The repository-wide Biome format check is affected by CRLF conversion across unchanged files in this Windows checkout; the commit hook formatted every staged release file, and Linux CI remains the canonical full-tree format gate.

Publishing behavior

After merge, a successful Main workflow will:

• publish githits@0.9.0, tag v0.9.0, create its GitHub release, and publish com.githits/githits@0.9.0 to the MCP registry
• publish @githits/mcp@0.9.0, tag mcp-v0.9.0, and create its GitHub release

The hosted remote MCP must then bump to @githits/mcp@0.9.0 and be redeployed before remote users receive the new package behavior.