chore(main): Release v9.26.0-rc

[github-actions]

🤖 I have created a release beep boop

9.26.0-rc (2026-09-11)

Features

• argocd: add configurable shared source repositories to projects (da9576f)
• server-nestjs: add Sécurité role to project system (c12f464)
• server-nestjs: backfill Sécurité project role on existing projects (c25a048), closes #2676
• server-nestjs: configurable Harbor robot expiration with enforced rotation headroom (c55fe13), closes #2679
• server-nestjs: proactive GitLab mirror token rotation with enforced headroom (f0139b6), closes #2691

Bug Fixes

• ci: fix hotfixes being performed with main as target branch (ff26269)
• client: clarify values file path hint per value source type (52ac9a3)
• client: guard syncRepository against cleared selectedRepo after await (d647925)
• client: use bundled ri icon for deployment sources (9498ecc)
• deployment: send value source paths to ArgoCD without <env> substitution (4e48cbc)
• nexus: re-add NexusError import dropped by idempotence refactor (749373b)
• observability: restore legacy dual-bucket Grafana RBAC sync (2ad58c1), closes #2686
• OpenCDS should have been enabled though plugin service not from main (2967d92)
• revert pnpm link to file protocol (f4510ee)
• server-nestjs: backfill default system roles on roleless projects (796870c), closes #2684
• server-nestjs: make Nexus create paths idempotent (409 conflict tolerance) (d1fea06), closes #2619
• server-nestjs: make SonarQube user creation idempotent on create race (1b29ad6), closes #2633
• server-nestjs: make the gitlab mirror rotation test deterministic (14a4f74), closes #2706

Miscellaneous Chores

• deps: mitigate Dependabot alerts via lock refresh and overrides (fa0677c), closes #2242

Docs

• record recurring agent rules in AGENTS.md (8cb0413)
• record recurring agent rules in AGENTS.md (de0eeed)
• record recurring agent rules in AGENTS.md (ccc27b1)
• record recurring agent rules in AGENTS.md (27d9a81)
• record recurring agent rules in AGENTS.md (3428d6e)
• record recurring agent rules in AGENTS.md (5c42a1e)
• record recurring agent rules in AGENTS.md (2778677)
• record recurring agent rules in AGENTS.md (933fd34)

Refactoring

• admin-role: remove dead testing-utils exports (9ed26e0)
• admin-roles: migrate from server (bec5bc9)
• gitlab: rename ensureCreated to ensure and extract race detection (7ebaf97)
• server-nestjs: route Keycloak group creation through shared ensure util (f3095b4)
• shared: add token pair generation and expiration schema (2d8c83b)

Reverted commits

• mitigate Dependabot alerts via lock refresh and overrides (11507fa)
• revert pnpm link to file protocol (6c9768f)

---

This PR was generated with Release Please. See documentation.