Validate Herdr 0.9.4 and update the managed installation baseline #411

Validate Herdr 0.9.4 across the supported operating systems and update Roamgate's managed installation baseline from 0.9.0. The version pin, checksums, installer tests, compatibility documentation, and isolated cross-platform backend checks are complete in merged #414. The maintainer has confirmed manual validation of the remaining browser and real-agent acceptance checks without observed issues. Herdr 0.9.4 retains private protocol 22 and stable endpoint generation 1; no protocol allowlist expansion or codec rewrite is currently indicated.

Existing evidence

• Official 0.9.4 release and release metadata.
• Current pin and checksum table.
• A checksum-verified macOS ARM64 0.9.4 binary passed an isolated smoke check using Roamgate's actual clients: RPC, event-subscription acknowledgement, endpoint welcome/snapshot, surface rendering, semantic text/Enter, pane.read, resize, tab/workspace creation, and passive notification endpoint attachment.
• 102 tests passed across herdr-client, endpoint-client, thin-client.tagged-contract, terminal-key-roundtrip, ssh-windows, and herdr/release suites. These do not constitute Windows/Linux runtime or complete browser verification.

Acceptance criteria

• Complete isolated macOS, Linux, and Windows runtime checks; record the tested architectures and any remaining limitations in the PR.
• Check terminal attach/reconnect, rendering/input/resize, workspace/tab creation, and notification delivery against a real backend and browser as applicable.
• Verify Antigravity/Grok returning to the prompt and Codex/Pi completion transitions do not cause duplicate notifications; preserve Herdr's foreground-idle semantics.
• Verify macOS long-command rejection is visible to the user and cannot silently lose or automatically replay a command. Add behavior changes only if verification exposes a defect.
• Pin VERIFIED_HERDR_VERSION to 0.9.4 and verify all five official asset SHA-256 values, including the Windows archive layout. Keep protocol 22.
• Update installer tests, Windows versioned-path references, docs/DEPLOYMENT.md, and relevant compatibility wording in docs/ARCHITECTURE.md without claiming untested support.
• Run the repository's required validation gates before committing. Keep temporary test sessions and binaries separate from existing services; do not upgrade or downgrade a live user server.

Verification completion

Automated and isolated backend validation is recorded in merged #414. Merged #415 additionally verifies installation and native plugin actions/panels without an external Bun runtime.

The maintainer confirmed manual validation of the remaining browser, real-agent state/notification, and macOS long-command acceptance checks without observed issues. Those acceptance items are marked complete based on the maintainer's confirmation, rather than additional automated runs. The same confirmation covers browser/OS notification delivery and Web Push as applicable; no new browser, device, or architecture matrix is claimed.

Third in the Herdr 0.9.4 compatibility follow-up sequence, after the plugin and Windows fixes. This issue does not authorize publishing a Roamgate release.

Planned predecessors: #409, then #410. Complete their fixes and the cross-platform checks before promoting the installer baseline.