Bump version to 0.9.1

[bbangert]

One-liner version bump for the 0.9.1 release.

What's in 0.9.1

Security — Erlang 29.0.2 → 29.0.4 via custom systems v0.1.6 / nerves_system_br 1.34.1 (#159). 12 CVEs, notably the SFTP-server spin (CVE-2026-54886), TLS-client MITM fixes (CVE-2026-54891, CVE-2026-55953) and ETF decode heap corruption / crash (CVE-2026-55737, CVE-2026-54890). Also Buildroot 2026.05.1. This is the first release that actually puts the fix on devices — the fleet has been on 29.0.2.

Nerves systems — all 8 forked targets to v0.1.6, plus the three stock systems that had been silently un-bumpable: bbb 2.30.1, mangopi_mq_pro 0.17.1, qemu_aarch64 0.4.1.

Dependency refresh — LiveView 1.2.9 + Phoenix 1.8.11 + live_dashboard 0.9.0 (#154), nerves 1.15.0 (#153), circuits_uart 1.6.0 (#152), tailwind 0.5.1 (#155), and 9 patch-level bumps (#151) including improv 0.1.2's WPA3/SAE association fix.

Cleanup — dropped the unused direct muontrap dependency (#158).

Release checklist (verified before this PR)

The two gotchas that broke past releases are both clear:

• firmware-release.yml pins ELIXIR_VERSION: 1.20.3-otp-29 / OTP_VERSION: 29.0.5, matching ci.yml — this workflow has its own copies, and drift is what broke 0.7.0
• Its target matrix is hand-maintained and now matches @all_targets exactly (11 targets, no grisp2/osd32mp1 leftovers)
• GITHUB_TOKEN is wired into the build job env, without which the artifact resolver rate-limits and 8/13 targets failed in 0.5.0

Verification

• mix compile --warnings-as-errors — PASS (exit 0)
• mise run test — 930 passed, 3 excluded

After merge, the release must be cut with a bare tag (0.9.1, no v prefix) pointing at the bump commit, since firmware metadata reads @version.

🤖 Generated with Claude Code