chore(release): v0.9.0 day-1 recheck — enterprise pin → 2d64baa + freeze-plan update

[trinity-ability]

Summary

Two changes from the 2026-08-12 freeze-week recheck (/release-plan recheck):

1. Enterprise submodule pin d1c5ebb → 2d64baa (MUST-immediate #2, overdue today).
The pin was left behind when the OSS half of the client_portal move (#2084, ent#356) merged — entitled builds mount a duplicate router on the same prefix and advertise a false client_portal entitlement (freeze-plan C2). Target is the enterprise-main tip, not just bce1175, because enterprise main advanced; the bump ships:

• bce1175 — remove client_portal from the enterprise tree (ent#356)
• e0a2ef4 — rooms: message budget counts conversation, not bookkeeping (ent#218)
• 0bee510 — rooms: post the reply before advancing the cursor (ent#220 partial)
• 2d64baa — workspace: managed session-policy API (ent#375 enterprise half; OSS half merged as feat(workspace): the session slides instead of expiring at 12 hours (ent#375) #2099)

2. Freeze-plan update (docs/releases/v0.9.0-freeze-plan.md):

• Day-1 RECHECK section: MUST-immediate 3/3 resolved, review-only items landed, fix(git): resolve the agent repo root with git rev-parse, not a content probe (#2075) #2076/feat(grid): widget chassis — InfoTile, GRID_WIDGETS registry, layout v2, Tiles menu (ent#325) #2042 still in review, trinity#2101 re-scope recorded
• Wave A +2 per eugene: A15 ent#384 (Library skills assignment, in progress) · A16 ci: dev's required checks run no unit tests, so two independently-green PRs can redden dev on contact #1958 (unit tests in dev's required checks — freeze-week guard)
• P0/P1 triage: all other open P0/P1 already status-in-dev; bug: deploy_local_agent (archive path) silently deploys incomplete agents — archive rides the LLM turn, symlinks dereferenced/fatal, zero integrity verification #2060 stays C12-conditional; Sessions rooms dark-mode: black-on-black text / UI glitches (NewRoomDialog, RoomsRail, Sessions backdrop) #1819 held behind B11
• Wave B owner recorded: dolho (all Workspace items as of 2026-08-12); critical path B8/ent#362 → B6/ent#361

Test plan

• Docs + submodule-pointer only; no code paths change in this repo
• Pin ancestry verified: d1c5ebb and bce1175 are both ancestors of 2d64baa on enterprise main; single Alembic head on the enterprise track was converged in d1c5ebb (trinity#2068) and no new revisions landed after it in this range except via reviewed enterprise PRs bug: PlatformAuditService missing 'log_event' method #374–bug: Execution shows Failed then Success after cleanup (race condition) #378

🤖 Generated with Claude Code

[vybe]

Pin ancestry + plan delta verified against the 2026-08-12 recheck. LGTM.