[OCR compatibility] Qualify v1.8.9

[github-actions]

OCR v1.8.9 compatibility evidence

• machine result: compatible
• classification: human-review-required
• all upstream asset digests and sha256sum.txt: verified
• Linux amd64 version/help/preview/result-consumer probes: passed

Upstream release changes

• release: https://github.com/alibaba/open-code-review/releases/tag/v1.8.9
• compare: alibaba/open-code-review@v1.8.8...v1.8.9
• current tested baseline: v1.8.8
• published: 2026-08-06T03:55:28Z

## 🚀 Features

- feat(viewer): add defense-in-depth security headers (#735)
- feat(benchmark): add Qwen3.8-Max results and show version inline per row (#726)

## 🐛 Bug Fixes

- fix(opencode): harden opencode plugin against abort, orphan, and arg edge cases (#728)
- fix(pages): inline critical CSS to remove the initial white flash (#601) (#610)
- fix(tool/code_search): guard option-like refs in buildGrepArgs (#727)

## 📖 Documentation

- docs(contributing): add tips for faster PR reviews section (#723)

## Other Changes

- Fix translation docs (#652)
- chore: add SPDX license headers and automated verification (#740)
- ci(pages): run tests in Pages workflow (#731)

**Full Changelog**: https://github.com/alibaba/open-code-review/compare/v1.8.8...v1.8.9

Classification reasons

• release notes contain a material or ambiguous compatibility signal

Human checklist

• Review upstream release notes and relevant commits.
• Confirm compatible or incompatible.
• Confirm tested support and recommended-version promotion.
• Route any compatibility change through protected PR and stable release gates.

Workflow evidence

• run: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/31243828961
• classification: human-review-required

[xeonvs]

Human review conclusion: OCR 1.8.9 is compatible with the toolkit. Viewer, benchmark, OpenCode plugin, Pages, documentation, SPDX, and CI changes are outside consumed toolkit contracts. Native code_search option-like reference hardening improves upstream defense in depth without changing the toolkit CLI, result, MCP, configuration, or GitLab boundary.

Release receipt:

• compatibility evidence: compatibility/evidence/ocr-1.8.9.json
• promotion feature PR: Qualify OCR 1.8.9 through 1.8.10 #67, verified merge 2b0f8393ba86a6150a694180b10bae7d0907db09
• combined release/closure PR: Release v0.4.6 #68, verified merge c87952559ec7e6bed4c1b38fcb0b41d2d5fcecf6
• stable release workflow: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/31250755741
• stable release: https://github.com/xeonvs/open-code-review-toolkit/releases/tag/v0.4.6 (immutable)
• PyPI/TestPyPI 0.4.6 wheel SHA-256: 7a944f5f1332728d857574d81cb484507eb3c5a6f5105d71a35dfbec0329307d
• PyPI/TestPyPI 0.4.6 sdist SHA-256: dcde562699c759764eb3cba4654cce511871c2e3c26a1ab2c1d9726fe94c5cba

Both registry provenance records identify release.yml, the exact release merge and workflow run, and their expected trusted-publishing environments. The annotated v0.4.6 tag resolves to the release merge; GitHub attestations and Python 3.12-3.14 published-artifact smokes pass. Closing as completed.