chore(release): quality & security hardening v0.9.0

[gfriloux]

GPG subprocess hardening:

• add --no-options to neutralize user gpg.conf on every invocation
• add -- before all positional path args (import, verify, decrypt, sign)
• fix backup_key: propagate set_permissions error instead of silencing it
• extract check_gpg_output helper (deduplicates 6 identical error checks)
• extract parse_verify_status as pure testable function; add 40-hex filter on VALIDSIG signer fingerprint before surfacing to frontend

Chat / JoinCode:

• verify: extract primary key fp via .last() (not fields[2] = subkey fp)
• add validate_fp guard at entry of chat_generate_join_code + chat_join_room
• add control-char check on room name in chat_create_room

Frontend quality:

• replace bare useKeysStore() with 4 granular selectors in useKeys.ts
• wrap .filter(has_secret) in useMemo in CreateRoomForm, JoinRoomForm, MyKeys
• handleDeleteRoom: rollback store if IPC fails
• move import React from mid-file to top of Chat.tsx
• remove dead IPC wrappers getCardInfo and verifySignature (wrong command names)
• remove dead data-theme useEffect in AppLayout

Tests:

• add 29 unit tests for validate_fp, validate_keyserver_url, validate_keyserver_query, parse_verify_status (30 → 59 total)
• centralize ENV_LOCK in tests/common/mod.rs

Build / CI:

• [workspace.dependencies] for chrono, serde, serde_json, tokio, uuid
• tokio: features = ["full"] → minimal set (rt, rt-multi-thread, sync, time, macros)
• docs.yml: npm install → npm ci; cache key package.json → package-lock.json
• release.yml: add rpm to artifacts; CHANGELOG step: continue-on-error removed, || true scoped to git push only
• mock-tauri.ts: expiry dates → 2028, unique room IDs per chat_create_room call

Bump version 0.8.9 → 0.9.0 in Cargo.toml, app/src-tauri/Cargo.toml, tauri.conf.json, app/package.json, packages/pgpilot/default.nix