[codex] Draft sbom-diff-and-risk v0.9.0 release notes

[stacknil]

Brief Design Summary

This PR drafts sbom-diff-and-risk v0.9.0 release notes.

The draft frames v0.9.0 as the policy JSON sidecar and consumer integration usability release. It captures the post-v0.8.0 work around --policy-json PATH, examples/sample-policy.json, the policy-gated GitHub Actions consumer example, and reviewer evidence documentation for outputs/policy.json.

This PR only drafts release notes. It does not bump package version, create a tag, create a GitHub Release, publish to PyPI/TestPyPI, or change runtime behavior.

Files Changed

• tools/sbom-diff-and-risk/RELEASE_NOTES_v0.9.0.md

Validation

• git diff --check passed.
• Checked the new release notes for Unicode Cf/Cc control or format characters; no non-tab/newline matches found.
• Confirmed referenced policy JSON example and consumer workflow files exist.
• Confirmed package metadata and runtime version remain 0.8.0.
• Confirmed .github/workflows is unchanged.
• No Python tests run because this is docs-only.

Out of Scope

• No runtime behavior changes
• No CLI changes in this PR
• No workflow changes
• No package version bump
• No tag or GitHub Release
• No PyPI/TestPyPI publishing
• No production PyPI workflow