Release 2.9.0

[heskew]

Release 2.9.0: bumps package.json/package-lock.json (version fields only) and moves ## [Unreleased] to ## [2.9.0] - 2026-10-02 in CHANGELOG.md. No code changes.

Included since 2.8.1:

• fix(mcp): add typ: at+jwt to access tokens, test no-store on token errors #262: typ: at+jwt on MCP access tokens (Conformance audit: MCP authorization spec 2026-07-28 (docs pin 2025-06-18 — two revisions stale) #202)
• fix: harden OAuth account-adoption gate (issuer fail-fast, UserInfo sub check, lookup-error quarantine) #263: account-adoption gate hardening (Follow-up hardening after the account-adoption gate (GHSA-vf58 / 2.6.0) #231 §4/§5)
• fix: redirect /login with a reason code on CSRF storage failure #267: /login reports reason=state_storage on a CSRF storage failure (/login propagates CSRF-state storage failures as a raw error response; /callback redirects with a reason code #227)
• fix: don't report a failed OAuth session clear as a completed logout #268: a failed OAuth session clear is no longer reported as a completed logout (A failed second clearOAuthSession in the refresh-failure path escapes as an unhandled rejection #265, clearOAuthSession reports success when an existing session can't be written #266)
• docs: add maintainer guide and canonical AGENTS.md #269: maintainer guide and canonical AGENTS.md
• feat: let an app choose which GitHub email becomes the login identity #270: onResolveEmail hook and existing-account email matching for GitHub (Support selecting which email becomes the login identity when a provider returns several (e.g. GitHub) #228)
• Derive the ID-token issuer from presets and OIDC discovery #271: ID-token issuer derivation from presets and OIDC discovery (Derive the ID-token issuer from presets and OIDC discovery so operators rarely set it #264)

After merge, publish GitHub Release v2.9.0 from main to trigger the npm publish.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the project version to 2.9.0 in package.json and package-lock.json, and documents the release in CHANGELOG.md. There are no review comments, and I have no feedback to provide.

[claude]

Reviewed; no blockers found.

[github-actions]

Reviewed; no blockers found.