Point new machines at the attested release v2026.09.23

[seathatflowsinourveins]

Moves adoption/manifest.json source.release_tag/release_commit from v2026.09.22.1 (bdd04ca) to v2026.09.23 (4970ba0), and updates the three docs that name the tag (README step 0, adoption/bootstrap.md, adoption/platforms/linux-wsl2.md).

Verified before pinning with gh attestation verify and the publish-catalog.yml signer workflow:

• the source archive (9083ace9…);
• the explorer (1589d453…, which equals the publish job's --check digest);
• the SPDX SBOM (902875ca…, predicate type https://spdx.dev/Document).

What the tag contains:

• it includes Fix the Codex review findings: promotion-gate parsing, anchored gitleaks allowlists, release-tag checkout #83 (the release-tag checkout in step 0) and Stop committing the generated explorer; keep the evidence manifest sorted #96 (the generated explorer);
• adoption/bootstrap.md and tools/adoption/render_config.py exist at 4970ba0.

Checks: full suite 2,740 OK. Validators pass. tests/test_adoption_contract.py checks that the tag resolves to the commit. Guarded gitleaks finds no leaks.

Follow-up: once the coordinating session signals that the remaining PRs have landed, a later tag (v2026.09.23.1) replaces this pin with the same procedure.

🤖 Generated with Claude Code