[FiraSenax]

This brings the reviewed RC4–RC8 security corrections and the RC9 follow-up onto protected main so the next public candidate can be signed from a merged commit.

• Require current, verified advisory sources before a positive assessment; preserve signed warnings and explain unreachable company sources in all supported UI languages.
• Authenticate update assets with tag-bound signatures, preserve observed key revocations, report damaged revocation state, and guard accidental emergency stops in CI.
• Preserve local history after clock errors, validate incoming sync changes, isolate damaged sync files and retain encrypted-history recovery guarantees.
• Integrate verified Microsoft VC++ runtime installation and the reviewed Linux runtime/license updates.
• Publish RC tags automatically only through the new main-ancestry check before production signing. This workflow guard does not separate an agent from a human sharing repository-owner credentials.

Validation: RC8's public signed release pipeline passed. Development run https://github.com/FiraSenax/KeyMelier/actions/runs/40870687807 passed 467 Python tests on all three OSes, 42 UI tests and 20 UI stress tests. The source gate has real-Git regression coverage for unmerged branches, annotated/lightweight tags, mismatched commits and acceptance only after merging. Advisory freshness and the revocation policy checks passed; no open Code Scanning alerts were returned during preparation.

After this PR passes its required checks and is merged, tag the exact merge commit as v1.8.7-rc.9 and let its signed publication pipeline finish. Existing RC tags remain unchanged; no stable release is published by this PR. Manual Linux hardware testing and the documented deferred hardening work remain open.