[socket-release-bot]

Bumps package.json to 1.9.0 and moves the ## [Unreleased] notes under the 1.9.0 heading.

To release:

1. Review the CHANGELOG section and squash-merge this PR.
2. Dispatch Publish to npm registry on v1.x with dry-run: false. It tags the merge commit, cuts the GitHub release, and stages all three packages.
3. Approve each staged package with pnpm stage approve.

If v1.x moves before this merges, re-dispatch with mode: release-pr to rebuild the bump on the new tip.

---

Note

Low Risk
Version and changelog-only release PR with no application code changes in the diff.

Overview
Release 1.9.0 — bumps package.json from 1.8.4 to 1.9.0 and promotes the former ## [Unreleased] changelog section to 1.9.0 (2026-10-20) with the GitHub release link.

No runtime or CLI code changes in this diff; it packages already-landed work for publish. The 1.9.0 notes call out Coana being fetched from Socket servers (cached under $XDG_CACHE_HOME/socket/coana), Coana CLI 15.12.10, and removal of SOCKET_CLI_COANA_LAUNCHER.

^{Reviewed by Cursor Bugbot for commit 82df999. Configure here.}