Upgrade Dex to 0.9.0

[longquanzheng]

Summary

• upgrade the released Dex Go SDK, Server tooling, CI, and documentation to v0.9.0
• pin all official dexcli v0.9.0 archive checksums and verify release provenance at e93b803a829735292af8c81a0cc1c98b12aee7f7
• document the v0.9.0 Server-first rollout required by SDK/Server protocol negotiation from Add SDK and CLI server protocol compatibility checks dex#481
• emit approval and Timer snapshot controls from their target WaitFor boundaries after RouteTool commits durable payloads
• preserve causal UI ordering when Activity Streams advance ahead of Snapshot reconciliation

Rationale

Dex v0.9.0 Workers call GetServerInfo before Attribute index synchronization or WorkerService binding and reject missing, invalid, or non-overlapping protocol intervals. SuperAgent therefore upgrades its SDK and released Server tooling together and documents that the Server must be deployed before the Worker.

The real-server upgrade also exposed an existing timing window where a best-effort Stream control could reach the browser before its durable pending interaction payload committed. Moving the control to the target wait boundary preserves the Snapshot-only durable read model.

User impact

Worker startup now fails early against an incompatible Dex Server. Approval and Timer controls remain visible without polling, and answered, steered, and queued user messages retain causal order during transient reconciliation.

Validation

• dexcli version check: protocol [1,1], negotiated protocol 1
• make check
• make check-flow-definition
• make test-integration against Dex v0.9.0
• full-stack Playwright against Dex v0.9.0: 17 passed