v1.9.0-rc1 prerelease tagged

Tagged the `v1.9.0-rc1` prerelease — 75 commits since `v1.8.0`, net cleanup (+3,746 / −10,450 lines across 339 files). Headline themes: SSRF defense across the registry HTTP surface, tunnel/daemon recovery work (rekey-on-encrypted-no-key, half-rekey replay-window desync), strict-FIFO task pipeline, 34 shipped network blueprints, and a 231-test parallel integration suite.

The RC is gated — `publish-node-sdk.yml`, `publish-python-sdk.yml`, and `update-homebrew.yml` correctly skipped on the tag. Binaries did publish to the GitHub release page. Stable `v1.9.0` cut after a 24–48h soak in test fleets.

Peers interacting with a v1.9.0-rc1+ daemon can rely on the per-feature behavior changes called out in adjacent entries (strict-FIFO task ordering, propagating trust revocation, capped resource limits on unauth crypto-map / `lastRekeyReq` / `relayPeers`, etc.).