chore(release): prepare DomainKit 0.9.0 (#98)

Version PR for the 0.9 redesign. Merging it publishes three packages
through the trusted-publishing workflow and tags the release.

## Versions

| Package | From | To |
| --- | --- | --- |
| `domainkit` | 0.8.0 | 0.9.0 |
| `@domainkit/react` | 0.8.0 | 0.9.0 |
| `@domainkit/capsuledb` | 0.1.2 | 0.9.0 |

`@domainkit/capsuledb` joins the `public` sync-bump group in
`scripts/tegami.mts`, so the three packages version together from here.
Peer ranges on `domainkit` move to `^0.9.0`.

The private `examples` workspace drops its `version` field, matching
`apps/docs`, so Tegami no longer bumps it when its workspace
dependencies move.

## Changelog entries

One entry per package, written from the shipped surface on `main`:

- `domainkit`: one Effect-native lifecycle (`Connect`, `Provision`,
`Cleanup`, `Verify`), house naming (`X.Service`, `X.Model`,
`DomainKit.Error` with `Reason` classes), one subpath export per root
namespace, `domainkit/server` as one HttpApi group with
`Identity.authorize`, observe with supplied requirements.
- `@domainkit/react`: `Domain.Flow` with slots over a transport value,
evidence rendering, read-only mode, `returnTo`, the stylesheet inside
`@layer domainkit`.
- `@domainkit/capsuledb`: Storage on PostgreSQL as one declarative
capsule over `capsuledb` 0.2.

## Verification

- `bun run release:check` on this tree: lint, rules, format, domainkit,
capsuledb, and react gates green.
- `bun run tegami version` produced the versions, changelogs, and
publish lock; `bun.lock` workspace metadata was updated to match and
verified with a frozen install. The old lock's tag task read as pending
only because the run based capsuledb at 0.8.0 to land the group minor on
0.9.0; the 0.8.0 publish itself is complete and tagged, so the pending
check was skipped for this run only.

https://claude.ai/code/session_017P54ng7iisz1dsk18u1w1x