Prepare CLI 0.3.9 for the hosted run-scope fixes

[jeffskafi]

Summary

Prepares @augmentworks/cli@0.3.9 the same way PR #78 (c9621d4) prepared 0.3.8. This packages the hosted run-scope lookup hardening from AUG-335 without publishing or recording a registry receipt.

Linear: AUG-336

• Base: main f94dbc532cd53b379e903f9cc139297fccae115d (merge of PR Harden hosted run-scope lookup against HTML error pages #84, AUG-335)
• Head: 137a426d0c8a9d23eedbe70d017753d28e01adb4
• Dependency commit: ff1689d (hosted run-scope lookup and HTML error handling)

What changed

• package.json and package-lock.json are 0.3.9. Lockfile changes are only those two version fields.
• Current-package pins in the README, docs, examples, agent resources, starters, discovery manifest, and schemas/v1/cli-release.json are 0.3.9. Agent resources and the discovery manifest were regenerated with npm run generate:agent-resources and npm run generate:discovery.
• CHANGELOG.md records 0.3.9 (2026-10-13) for the AUG-335 fix, plus the unreleased FAQ example and 0.3.8 inspection note that ship with this source.
• thisPackageIdentity is 0.3.9 with status: pending-protected-publish. gitHead, integrity, verifiedAt, githubRelease, and githubReleasePublishedAt are null. lastIndependentlyInspected and immutableArtifacts still record inspected 0.3.8.

No tag, GitHub release, or npm publish. Publication stays with the package owner (docs/distribution-runbook.md).

Tests

npm run audit:ci passed with the agent environment as-is (0 high vulnerabilities).

The first npm run check failed only in billing CLI tests: this environment sets AUGMENTWORKS_API_KEY, and those tests also set a different AUGMENTWORKS_TOKEN, so they exit 3 with AUTH_ENV_CONFLICT. No test or runtime behavior was changed for that. With AUGMENTWORKS_API_KEY unset:

• npm run check passed (110 files, 1092 passed, 1 skipped). Discovery check reports @augmentworks/cli@0.3.9 (development) and last inspected 0.3.8.
• npm run smoke:pack passed (74 files).
• npm run test:packed-core-release:local exited 0. registry-identity and live-authorized-environment stay not_run, so releaseReady is false on the local packed path.

Linear Issue: AUG-336