release: v3.9.0 (plan resolution binds to a root, refusals are never silent)

Closes #212, #211, #210.

#212: a Codex thread whose cwd was a shared parent injected an unrelated
project's plan on every hook fire. PWF_PLAN_ROOT binds resolution to a project
root by absolute path, which a cwd relative PLAN_ID slug could not express,
and an ambiguous cwd refuses to inject rather than guessing.

Verifying that report exposed three more failures: PLANNING_DISABLED=1 was
inoperative on eleven of thirteen install routes, the Stop hook could never
find its script on six hosts, and eight shipped PowerShell scripts could not
be parsed by Windows PowerShell 5.1 at all, leaving Cursor injection and both
Chinese variants' init-session dead on Windows.

#211: a provider error made the Pi extension queue another request into the
same failing provider, up to the auto continue limit, burying the original
error. The status bar also stopped tracking the plan once execution was
approved. Bundled extension 1.2.3.

#210: injection determinism is now asserted rather than assumed, five routes
that had never received the v2.40 timestamp normalization were fixed, and the
skill text no longer attributes a whole workflow token measurement to per tool
call recitation.

Suite 311 to 411 passing, 282 to 467 subtests, 48 Pi extension tests, IDE
folder sync clean.