chore(main): Release v9.26.0-rc

[github-actions]

🤖 I have created a release beep boop

9.26.0-rc (2026-09-09)

Features

• server-nestjs: configurable Harbor robot expiration with enforced rotation headroom (c55fe13), closes #2679
• server-nestjs: proactive GitLab mirror token rotation with enforced headroom (f0139b6), closes #2691

Bug Fixes

• ci: fix hotfixes being performed with main as target branch (ff26269)
• client: guard syncRepository against cleared selectedRepo after await (d647925)
• client: use bundled ri icon for deployment sources (9498ecc)
• deployment: send value source paths to ArgoCD without <env> substitution (4e48cbc)
• nexus: re-add NexusError import dropped by idempotence refactor (749373b)
• observability: restore legacy dual-bucket Grafana RBAC sync (2ad58c1), closes #2686
• OpenCDS should have been enabled though plugin service not from main (2967d92)
• server-nestjs: backfill default system roles on roleless projects (796870c), closes #2684
• server-nestjs: make Nexus create paths idempotent (409 conflict tolerance) (d1fea06), closes #2619
• server-nestjs: make SonarQube user creation idempotent on create race (1b29ad6), closes #2633

Refactoring

• admin-role: remove dead testing-utils exports (9ed26e0)
• admin-roles: migrate from server (bec5bc9)
• gitlab: rename ensureCreated to ensure and extract race detection (7ebaf97)
• server-nestjs: route Keycloak group creation through shared ensure util (f3095b4)
• shared: add token pair generation and expiration schema (2d8c83b)

---

This PR was generated with Release Please. See documentation.