chore: release v2.0.0-alpha.9

[levifig]

Summary

• Prepare Loaf v2.0.0-alpha.9 from landed main commit 974edf84c9b6b3de6e7a939abfdb0cdf6a6034a8.
• Publish the installed-distribution authority hotfix in version metadata, the lockfile, target manifests, generated distributions, and six platform-native binaries.
• Refresh the strict real U8 receipts for Claude Code 2.1.207, Codex 0.144.1, and OpenCode 1.17.18 through their sanctioned isolated smoke writers.

Release note

Fixed

• Use the installed executable's packaged distribution for version reporting, upgrades, configuration maintenance, and diagnostics, preventing stale source checkouts from silently downgrading managed installations while preserving explicit source-checkout builds (fix: enforce installed distribution authority #120).

Test plan and evidence

• npm ci
• LOAF_VALIDATE_TYPESCRIPT=1 npm run build
• go test ./cmd/loaf -run TestInstalledDistribution -count=1
• go test ./internal/cli -run 'TestResolveInstalledDistribution|TestRunnerVersion.*Distribution|TestRunnerVersionOmits|TestRunnerInstallFailsClosed|TargetCapability|InstalledSmoke' -count=1
• go vet ./...
• go test ./... -count=1
• npm run typecheck
• npm run test
• npm run build:release with fresh isolated Go module/build caches; all six target binaries built
• npm run package:release; all six archives packaged and verified by shasum -a 256 -c checksums.txt
• ./bin/loaf change check docs/changes/20260718-installed-distribution-authority
• npm run verify:go-artifacts with isolated Go caches
• Real isolated U8 smokes passed for Claude Code 2.1.207, Codex 0.144.1, and OpenCode 1.17.18; all receipts agree with the darwin-arm64 native SHA-256 5b76b90e835834bea3f4208cb8fa4e344951e43ab90f986837f09ac3d6eb2519
• Repeated typed builds produced the same aggregate changed-file digest dd59026ee6a38fa78effc11648ca85787f6096bb0c774205b7f25b2744bacfcd
• git diff --check
• Independent Claude Fable 5/xhigh read-only review: APPROVE, no HIGH or MEDIUM findings

Non-blocking LOW observations

Hotfix follow-ups (outside release notes)

• Align Homebrew documentation wording with the current bin.write_exec_script launcher behavior instead of describing it as a symlink.
• Expand setup documentation for the split authority model: explicit source-checkout builds versus installed-distribution maintenance.
• Add dedicated direct assertions for degraded doctor/configuration paths beyond the current end-to-end coverage.

Release review observations

• The darwin-arm64 binary was preserved from the independently reviewed hotfix candidate while the other five platform binaries were refreshed; hashes and reproducibility checks reconcile the candidate.
• Strict real receipts are darwin-arm64-only by design; the other platforms are covered by the six-target build, packaging, and checksum gates.
• plugins/loaf/package.json retains its pre-existing generated no-trailing-newline formatting.

This PR prepares the release commit only. It does not create or push the tag, publish a GitHub Release, update Homebrew, or mutate global Loaf installations.