release: ship v1.9.0 real use case

[sergeliatko]

What changed

• Replace the abstract founding demonstration with the real release-automation use case drawn from three repositories across two organizations.
• Trace the selected and rejected controls into pull request Optimize deterministic skill releases for v1.3.1 #25, the v1.3.1 cross-host failure, and the v1.3.2 correction.
• Link the case to the release preflight, deterministic ZIP builder, asset verifier, release-state guard, and delivery workflows that still operate here.
• Remove internal evidence-management labels from the README, quickstart, and provenance landing path.
• Synchronize the package, plugin, changelog, version, and release-note identity at v1.9.0.

Why

Issue #22 remained valid after the earlier README update. The landing page named the portfolio scale but still described the use case through generic validation language, which hid the concrete result and made the product story feel hypothetical.

Impact

Readers can now follow one real request from portfolio discovery through implementation and operational correction. Private repository identities, paths, credentials, and raw inventory records remain excluded. The installable runtime, activation behavior, safety contract, permissions, and package formats are unchanged.

Verification

• npm run validate
• npm run package -- v1.9.0
• npm run release:verify-assets -- v1.9.0
• npm run release:preflight -- v1.9.0
• Manual inventory review of all three ZIP packages and SHA256SUMS
• Static review of the affected privacy and publication adversarial cases

Final preflight tree digest: b6c9f525e60f209825781c1d6051a415d2bda158da1d2f72cc84d072925e2036

Closes #22