Prepare Cardbound v0.9.2 release candidate

[MisterTriangle]

What changed

• Publishes the clean Cardbound v0.9.2 source candidate, documentation, resources, tests, GitHub issue forms, and Java 11 CI.
• Adds the expanded pack/catalogue rules, guided setup, Binder and quest improvements, death recovery, exemptions, visual refresh, Wiki/Discord/Patreon links, and related settings.
• Excludes local credit-test controls, test-client launchers, generated packages, saves, marketing material, and private workspace records.

Why

The earlier v0.9.2 work was mixed with a local-only testing layer. This branch was rebuilt directly from main so the public source remains reviewable and cannot accidentally ship test-credit tooling.

The persistence path also had a shutdown risk: a plugin-owned executor could cancel the final queued save. Cardbound now queues an immutable final snapshot on RuneLite's injected scheduler without blocking or cancelling the shared executor.

Validation

• Commit: 21c84cd
• Java 11: clean test build shadowJar passed
• Automated tests: 113 passed, 0 failures/errors/skips across 27 suites
• git diff main...HEAD --check passed
• Plain plugin JAR scan found no service-provider file, template residue, test launcher, or local credit controls
• Production policy scan found no reflection, JNI/native access, process execution, runtime code loading, input injection, blocking sleeps/waits, forbidden HTTP clients, Java serialization, unmanaged executors, or desktop URL opening

Human and review gates

This PR is intentionally a draft. Joshua still needs to complete the exact-commit clean-account and Group Ironman in-game checklist. Cardbound has not been submitted to or approved by the RuneLite Plugin Hub. Click cancellation and optional NPC hiding remain reviewer-sensitive and require RuneLite maintainer review.