release(v0.9.0): bump versions to 0.9.0 + CHANGELOG + STATUS/ROADMAP/spec sync

Org GUI (read+write) + pluggable second factor feature-complete (all 5 streams
merged at 6d6e9f8). Versions: extension manifests + core/cli/wasm -> 0.9.0
(manifest.firefox.json 0.7.0-drift corrected); relicario-server stays 0.1.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013Hc6Rvdz3DxLucqNtPE2iP

ROADMAP.md

@@ -7,6 +7,7 @@
 
 | Version | Highlights |
 |---|---|
+| **v0.9.0** *(2026-06-27)* | **Org vault in the browser extension (read + write) + pluggable second factor** (`6d6e9f8`, 5 streams under PM/relay coordination). **Org GUI:** Personal/<org> context switcher, grant-filtered browse + view of all 7 item types, add-org config flow, and add/edit/delete via ed25519-**signed commits** pushed over native git (`git-receive-pack` + an in-browser isomorphic-git packfile encoder — host-agnostic, Gitea *and* GitHub at any version; Gitea has no signature-carrying write REST API); org admin stays CLI-only. **Pluggable second factor:** a plain key file (`.relkey`) as an alternative to the stego reference image — same 256-bit secret + Argon2id KDF; CLI (`init --key-file`, `RELICARIO_KEYFILE`) + extension (wizard/unlock/attach); positioning re-led on the two-factor-KDF thesis. **Device-key lifecycle completed** (device private key persisted encrypted under the master key, restored into the WASM session at unlock, never crosses to JS). Extension 584/584; core/cli/wasm + extension → 0.9.0, `relicario-server` 0.1.1. |
 | **v0.8.2** *(2026-06-25)* | **Extension vault-creation fix** (`938174b`): binary-safe `chrome.runtime.sendMessage` transport (`message-binary.ts` — base64-envelopes `ArrayBuffer`/`TypedArray` payloads the channel otherwise drops, which had reduced carrier JPEGs to 0 bytes → opaque "no SOF marker found in JPEG", breaking vault create/attach) wired at all four message boundaries; carrier-image magic-byte guard with actionable errors; setup-wizard router allowlist (`create_vault`/`attach_vault`/`generate_recovery_qr`); vault-tab drawer/lock layout fixes. Extension-only (core/cli/wasm bumped 0.8.1→0.8.2 for tag consistency, `relicario-server` stays 0.1.1); 435/435 vitest. |
 | **v0.8.1** *(2026-06-20)* | **Org item-type parity + collection-scoped attachments + grant-scoped hook** (`4c0a289`, four parallel streams): `relicario org add`/`edit` now cover **all 7 item types** — Card/Key/Totp (Dev-B `6e73c5e`) and Document (Dev-C `4c0a289`) on the shared `item_build` foundation (Dev-A `b09e0ce`); org attachments stored collection-scoped at `attachments/<slug>/<item-id>/<att-id>.enc` with a default cap (Dev-C); `relicario-server` `classify_path` grant-scopes those attachment writes (Dev-D `db4e05a`, server `0.1.1` — **requires pre-receive hook redeploy**). **Still deferred:** extension org read/write (forward plan: `docs/superpowers/specs/2026-06-20-extension-cli-parity-gap-analysis.md`); org phase 2. |
 | v0.8.0 *(2026-06-20)* | **Enterprise org vault — backend complete** (`7392795`): relicario-core `org` module (ECIES X25519 key wrap/unwrap, `OrgRole`/`OrgMember`/`OrgManifest` types, `filter_for_member`, `schema_version: 1`); relicario-server org hook (`verify-org-commit`: signature verification, path-scoped authz, `enforce_owner_only_elevation` on parent role, `enforce_schema_monotonicity`, `generate-org-hook`, new `[lib]` target); relicario-cli — all 19 `relicario org` subcommands: init, add-member/remove-member/set-role, create-collection/grant/revoke, rotate-key (re-encrypts all blobs), transfer-ownership, delete-org, status, audit, and item CRUD (add/get/list/edit/rm/restore/purge). Org item-type parity for Card/Key/Document/Totp shipped subsequently in v0.8.1; extension org parity + phase 2 (SSO/LDAP, read audit, per-collection subkeys, HTTP plane) remain deferred. |
@@ -18,10 +19,9 @@ See `CHANGELOG.md` for tagged-release detail and `STATUS.md` for the per-train c
 
 ## Up next
 
-All three 2026-05-04 architecture-review specs are shipped; the enterprise org vault backend (v0.8.0) and org item-type parity + collection-scoped attachments (v0.8.1) are shipped. Forward plan for extension parity: `docs/superpowers/specs/2026-06-20-extension-cli-parity-gap-analysis.md`. Pending items in rough priority order:
+All three 2026-05-04 architecture-review specs are shipped; the enterprise org vault (backend v0.8.0/v0.8.1, **extension read + write in v0.9.0**) and the **pluggable second factor (v0.9.0)** are shipped. Pending items in rough priority order:
 
-- **Extension org parity — read** — org switch + collection-filtered browse in the popup/vault tab (Dev-D, deferred)
-- **Extension org parity — write** — `org add`/`edit`/`rm` from the extension (Plan B-2; the CLI side reached all-7-type org write in v0.8.1, so this is unblocked CLI-side)
+- **v0.9.0 follow-ups** — `backup --include-keyfile` (key-file vault backups); the `gitea.ts putBlob` latent bug (large attachments 404 on Gitea); Dev-A's M1 (one-time device-migration user notice) + M2 (corrupt `device_key_enc` recovery path); org-write m2 (TOCTOU manifest dual-read) + m5 (zero-grant `+new` button / push-rejection error copy)
 - **Personal-side extension gaps** — favorites UI, group/tag/filter editing across all type forms, attachment-remove router wire + per-item purge UI, autofill registrable-domain matching (per the parity gap analysis)
 - **Phase 4: command palette** — ⌘K global search + action dispatch across the vault tab (no spec yet)