chore(release): bump version to 0.9.3

[orieg]

Summary

Prepare the v0.9.3 patch release: bump pyproject.toml 0.9.2 → 0.9.3.

Per CONTRIBUTING.md § Release Process, a release is: (1) update version in pyproject.toml, (2) tag matching the version, which triggers release.yml (GitHub release) and publish.yml (PyPI). release.yml hard-fails if the tag doesn't match the package version, so this bump must land on main first.

This bump-only PR matches the last several releases (0.8.x–0.9.2), which did not touch CHANGELOG.md (release notes are GitHub auto-generated). Note: scripts/release.sh is stale — it assumes the pre-0.8.0 -dev suffix flow and pushes directly to main, which branch protection now blocks; do not use it.

Included since v0.9.2

• fix(engine): mask declared secrets in dry-run previews and param-default logs (fix(engine): mask declared secrets in dry-run previews and param-default logs #36)
• fix: clear 26 CodeQL clear-text-logging false positives (fix: clear 26 CodeQL clear-text-logging false positives #35) — tests only
• 7 dependency-group bumps (chore(deps): bump the github-actions group with 4 updates #25, chore(deps): bump the github-actions group across 1 directory with 2 updates #27, chore(deps-dev): bump the dependencies group across 1 directory with 2 updates #29, chore(deps-dev): bump black from 26.5.0 to 26.5.1 in the dependencies group #30, chore(deps): bump codecov/codecov-action from 6 to 7 in the github-actions group #31, chore(deps): bump the github-actions group across 1 directory with 2 updates #33, chore(deps-dev): bump the dependencies group with 2 updates #34)

After merge

git fetch origin main && git tag v0.9.3 origin/main && git push origin v0.9.3

[Copilot]

Pull request overview

Prepares the v0.9.3 patch release by aligning the package version with the intended release tag and adding release notes to the changelog (required for the release workflow’s tag/version consistency check).

Changes:

• Bump project version in pyproject.toml from 0.9.2 to 0.9.3.
• Add a 0.9.3 section to CHANGELOG.md documenting fixes included since 0.9.2.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
pyproject.toml	Updates the package version to 0.9.3 for the release/tag workflow requirement.
CHANGELOG.md	Adds a 0.9.3 release entry describing included fixes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.