Release v0.9.4

[zircote]

Bumps package.json and .claude-plugin/plugin.json to 0.9.4 and finalizes the CHANGELOG's Unreleased section under this version.

Ships five fixes since v0.9.3:

• validate-plugin gate never inspects commands/ (or agents/) — a malformed command frontmatter passes silently #186 (PR fix: validate commands/ and agents/ frontmatter in the validate-plugin gate #207): the validate-plugin gate now inspects commands/**/*.md and agents/**/*.md frontmatter, with a plugin-root override (CLI arg or VALIDATE_PLUGIN_ROOT, both empty-safe) for fixture-tree tests.
• validate-plugin: MARKETPLACE_SCHEMA rejects the string-shorthand plugin source form #183 (PR fix: accept the string-shorthand plugin source form in MARKETPLACE_SCHEMA #205): MARKETPLACE_SCHEMA accepts the string-shorthand plugin source form.
• validate-plugin: malformed plugin.json or marketplace.json crashes instead of reporting a validation error #182 (PR fix(validate-plugin): report malformed plugin.json/marketplace.json as validation errors #206): malformed plugin.json/marketplace.json report as structured validation errors instead of crashing the gate.
• docs/adr/0001-0005 violate the plugin's own adr genre skill (no type: adr, no status:), so audit-v2's immutable-ADR policy never engages on them #203 (PR Make the five docs/adr ADRs conform to the adr genre and route them to the structured-madr gate #208): the repo's five ADRs conform to the adr genre (structured-MADR frontmatter), with the content-based corpus carve-out and the adr-smadr CI job gating docs/adr/ in both modes.
• A type: adr document outside docs/adr/ escapes both gates: the corpus carve-out is content-based, the adr-smadr job is directory-scoped #209 (PR fix: fail closed on a type: adr document the adr-smadr gate cannot see #210): corpus.mjs fails closed on a type: adr document the adr-smadr job cannot see, closing the carve-out/gate coverage gap.

After merge: publish GitHub release v0.9.4, which fires the attested-delivery release.yml (changelog-check → build → attest → verify → upload).

[Copilot]

Pull request overview

Releases v0.9.4 by bumping the plugin/package versions and rolling the previously “Unreleased” changelog entries into a tagged 0.9.4 section.

Changes:

• Bump package.json version to 0.9.4.
• Bump .claude-plugin/plugin.json version to 0.9.4.
• Finalize CHANGELOG.md by adding a 0.9.4 section dated 2026-08-04 and updating its modified timestamp.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
package.json	Version bump to 0.9.4 for the npm package metadata.
CHANGELOG.md	Moves Unreleased notes into a new 0.9.4 release section and updates changelog metadata.
.claude-plugin/plugin.json	Version bump to 0.9.4 for the Claude plugin manifest.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.