chore(release): v2.9.0

[octalide]

Release cut for v2.9.0. Bumps version 2.8.0 -> 2.9.0 and adds the CHANGELOG entry.

Since v2.8.0:

• Darwin OS + Mach-O dynamic executables -> both x86_64-darwin and aarch64-darwin triples (target OS: macOS / Darwin (runtime, syscalls, entry) #1178)
• riscv64 RV64A atomic inline-asm mnemonics (riscv64 inline-asm: RV64A atomic mnemonics (lr/sc, amo*, ordering suffixes) #1668)
• riscv64 backend hardening: long-branch relaxation (codegen(riscv64): no long-branch relaxation; out-of-range B-type branch fails to encode #1666), frame-slot overlap fix (codegen(riscv64): local frame slots overlap the saved ra/s0 record (silent SIGSEGV with any stack local) #1670), 32-bit and/or/xor SIGILL fix (codegen(riscv64): 32-bit and/or/xor encode illegal word-group ops (SIGILL) #1672)
• constant-time secret-qualifier flow typing (sema: secret-qualifier flow typing — join, gate, welded-storage pointers #1645)

Minor bump (Darwin/CT-sema are new capabilities). After this merges I open dev -> main and tag v2.9.0. v2.9.0 makes riscv64 compile + run real std, unblocking the mach-std riscv64 atomics (#308) and runtime (#307) to land with a green riscv64 lane.